mlz.json

{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.28.1.47646",
      "templateHash": "8962868757577362982"
    }
  },
  "parameters": {
    "resourcePrefix": {
      "type": "string",
      "minLength": 3,
      "maxLength": 6,
      "metadata": {
        "description": "A prefix, 3-6 alphanumeric characters without whitespace, used to prefix resources and generate uniqueness for resources with globally unique naming requirements like Storage Accounts and Log Analytics Workspaces"
      }
    },
    "environmentAbbreviation": {
      "type": "string",
      "defaultValue": "dev",
      "allowedValues": [
        "dev",
        "prod",
        "test"
      ],
      "metadata": {
        "description": "The abbreviation for the environment."
      }
    },
    "hubSubscriptionId": {
      "type": "string",
      "defaultValue": "[subscription().subscriptionId]",
      "metadata": {
        "description": "The subscription ID for the Hub Network and resources. It defaults to the deployment subscription."
      }
    },
    "identitySubscriptionId": {
      "type": "string",
      "defaultValue": "[subscription().subscriptionId]",
      "metadata": {
        "description": "The subscription ID for the Identity Network and resources. It defaults to the deployment subscription."
      }
    },
    "operationsSubscriptionId": {
      "type": "string",
      "defaultValue": "[subscription().subscriptionId]",
      "metadata": {
        "description": "The subscription ID for the Operations Network and resources. It defaults to the deployment subscription."
      }
    },
    "sharedServicesSubscriptionId": {
      "type": "string",
      "defaultValue": "[subscription().subscriptionId]",
      "metadata": {
        "description": "The subscription ID for the Shared Services Network and resources. It defaults to the deployment subscription."
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "[deployment().location]",
      "metadata": {
        "description": "The region to deploy resources into. It defaults to the deployment location."
      }
    },
    "supportedClouds": {
      "type": "array",
      "defaultValue": [
        "AzureCloud",
        "AzureUSGovernment"
      ],
      "metadata": {
        "description": "Supported Azure Clouds array. It defaults to the Public cloud and the Azure US Government cloud."
      }
    },
    "deployIdentity": {
      "type": "bool",
      "metadata": {
        "description": "Choose to deploy the identity resources. The identity resoures are not required if you plan to use cloud identities."
      }
    },
    "deployNetworkWatcher": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Choose whether to deploy network watcher for the desired deployment location. Only one network watcher per location can exist in a subscription."
      }
    },
    "deploymentNameSuffix": {
      "type": "string",
      "defaultValue": "[utcNow()]",
      "metadata": {
        "description": "A suffix to use for naming deployments uniquely. It defaults to the Bicep resolution of the \"utcNow()\" function."
      }
    },
    "tags": {
      "type": "object",
      "defaultValue": {},
      "metadata": {
        "description": "A string dictionary of tags to add to deployed resources. See https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources?tabs=json#arm-templates for valid settings."
      }
    },
    "hubVirtualNetworkAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.128.0/23",
      "metadata": {
        "description": "The CIDR Virtual Network Address Prefix for the Hub Virtual Network."
      }
    },
    "hubSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.128.128/26",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the default Hub subnet. It must be in the Hub Virtual Network space."
      }
    },
    "firewallClientSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.128.0/26",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the Azure Firewall Subnet. It must be in the Hub Virtual Network space. It must be /26."
      }
    },
    "firewallManagementSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.128.64/26",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the Azure Firewall Management Subnet. It must be in the Hub Virtual Network space. It must be /26."
      }
    },
    "identityVirtualNetworkAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.130.0/24",
      "metadata": {
        "description": "The CIDR Virtual Network Address Prefix for the Identity Virtual Network."
      }
    },
    "identitySubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.130.0/24",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the default Identity subnet. It must be in the Identity Virtual Network space."
      }
    },
    "operationsVirtualNetworkAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.131.0/24",
      "metadata": {
        "description": "The CIDR Virtual Network Address Prefix for the Operations Virtual Network."
      }
    },
    "operationsSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.131.0/24",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the default Operations subnet. It must be in the Operations Virtual Network space."
      }
    },
    "sharedServicesVirtualNetworkAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.132.0/24",
      "metadata": {
        "description": "The CIDR Virtual Network Address Prefix for the Shared Services Virtual Network."
      }
    },
    "sharedServicesSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.132.0/24",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the default Shared Services subnet. It must be in the Shared Services Virtual Network space."
      }
    },
    "firewallSkuTier": {
      "type": "string",
      "allowedValues": [
        "Standard",
        "Premium",
        "Basic"
      ],
      "metadata": {
        "description": "[Standard/Premium/Basic] The SKU for Azure Firewall. It defaults to \"Premium\". Selecting a value other than Premium is not recommended for environments that are required to be SCCA compliant."
      }
    },
    "firewallThreatIntelMode": {
      "type": "string",
      "defaultValue": "Alert",
      "allowedValues": [
        "Alert",
        "Deny",
        "Off"
      ],
      "metadata": {
        "description": "[Alert/Deny/Off] The Azure Firewall Threat Intelligence Rule triggered logging behavior. Valid values are \"Alert\", \"Deny\", or \"Off\". The default value is \"Alert\"."
      }
    },
    "firewallIntrusionDetectionMode": {
      "type": "string",
      "defaultValue": "Alert",
      "allowedValues": [
        "Alert",
        "Deny",
        "Off"
      ],
      "metadata": {
        "description": "[Alert/Deny/Off] The Azure Firewall Intrusion Detection mode. Valid values are \"Alert\", \"Deny\", or \"Off\". The default value is \"Alert\"."
      }
    },
    "enableProxy": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "[true/false] The Azure Firewall DNS Proxy will forward all DNS traffic. When this value is set to true, you must provide a value for \"dnsServers\""
      }
    },
    "dnsServers": {
      "type": "array",
      "defaultValue": [
        "168.63.129.16"
      ],
      "metadata": {
        "description": "['168.63.129.16'] The Azure Firewall DNS Proxy will forward all DNS traffic. When this value is set to true, you must provide a value for \"servers\". This should be a comma separated list of IP addresses to forward DNS traffic"
      }
    },
    "firewallDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "AzureFirewallApplicationRule",
          "enabled": true
        },
        {
          "category": "AzureFirewallNetworkRule",
          "enabled": true
        },
        {
          "category": "AzureFirewallDnsProxy",
          "enabled": "[parameters('enableProxy')]"
        }
      ],
      "metadata": {
        "description": "An array of Firewall Diagnostic Logs categories to collect. See \"https://docs.microsoft.com/en-us/azure/firewall/firewall-diagnostics#enable-diagnostic-logging-through-the-azure-portal\" for valid values."
      }
    },
    "firewallDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [
        {
          "category": "AllMetrics",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Firewall Diagnostic Metrics categories to collect. See \"https://docs.microsoft.com/en-us/azure/firewall/firewall-diagnostics#enable-diagnostic-logging-through-the-azure-portal\" for valid values."
      }
    },
    "firewallClientPublicIPAddressAvailabilityZones": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Azure Firewall Public IP Address Availability Zones. It defaults to empty, or \"No-Zone\", because Availability Zones are not available in every cloud. See https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#sku for valid settings."
      }
    },
    "firewallManagementPublicIPAddressAvailabilityZones": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Azure Firewall Public IP Address Availability Zones. It defaults to empty, or \"No-Zone\", because Availability Zones are not available in every cloud. See https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#sku for valid settings."
      }
    },
    "firewallSupernetIPAddress": {
      "type": "string",
      "defaultValue": "10.0.128.0/18",
      "metadata": {
        "description": "Supernet CIDR address for the entire network of vnets, this address allows for communication between spokes. Recommended to use a Supernet calculator if modifying vnet addresses"
      }
    },
    "publicIPAddressDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "DDoSProtectionNotifications",
          "enabled": true
        },
        {
          "category": "DDoSMitigationFlowLogs",
          "enabled": true
        },
        {
          "category": "DDoSMitigationReports",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Public IP Address Diagnostic Logs for the Azure Firewall. See https://docs.microsoft.com/en-us/azure/ddos-protection/diagnostic-logging?tabs=DDoSProtectionNotifications#configure-ddos-diagnostic-logs for valid settings."
      }
    },
    "publicIPAddressDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [
        {
          "category": "AllMetrics",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Public IP Address Diagnostic Metrics for the Azure Firewall. See https://docs.microsoft.com/en-us/azure/ddos-protection/diagnostic-logging?tabs=DDoSProtectionNotifications for valid settings."
      }
    },
    "hubVirtualNetworkDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Logs to enable for the Hub Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#logs for valid settings."
      }
    },
    "hubVirtualNetworkDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Metrics to enable for the Hub Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "hubNetworkSecurityGroupRules": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Rules to apply to the Hub Virtual Network. See https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules?tabs=bicep#securityrulepropertiesformat for valid settings."
      }
    },
    "hubNetworkSecurityGroupDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "NetworkSecurityGroupEvent",
          "enabled": true
        },
        {
          "category": "NetworkSecurityGroupRuleCounter",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Network Security Group diagnostic logs to apply to the Hub Virtual Network. See https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log#log-categories for valid settings."
      }
    },
    "hubNetworkSecurityGroupDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Metrics to apply to enable for the Hub Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "identityVirtualNetworkDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Logs to enable for the Identity Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#logs for valid settings."
      }
    },
    "identityVirtualNetworkDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Metrics to enable for the Identity Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "identityNetworkSecurityGroupRules": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Rules to apply to the Identity Virtual Network. See https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules?tabs=bicep#securityrulepropertiesformat for valid settings."
      }
    },
    "identityNetworkSecurityGroupDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "NetworkSecurityGroupEvent",
          "enabled": true
        },
        {
          "category": "NetworkSecurityGroupRuleCounter",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Network Security Group diagnostic logs to apply to the Identity Virtual Network. See https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log#log-categories for valid settings."
      }
    },
    "identityNetworkSecurityGroupDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Metrics to apply to enable for the Identity Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "keyVaultDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "AuditEvent",
          "enabled": true
        },
        {
          "category": "AzurePolicyEvaluationDetails",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Key Vault Diagnostic Logs categories to collect. See \"https://learn.microsoft.com/en-us/azure/key-vault/general/logging?tabs=Vault\" for valid values."
      }
    },
    "operationsVirtualNetworkDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Logs to enable for the Operations Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#logs for valid settings."
      }
    },
    "operationsVirtualNetworkDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Metrics to enable for the Operations Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "operationsNetworkSecurityGroupRules": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group rules to apply to the Operations Virtual Network. See https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules?tabs=bicep#securityrulepropertiesformat for valid settings."
      }
    },
    "operationsNetworkSecurityGroupDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "NetworkSecurityGroupEvent",
          "enabled": true
        },
        {
          "category": "NetworkSecurityGroupRuleCounter",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Network Security Group diagnostic logs to apply to the Operations Virtual Network. See https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log#log-categories for valid settings."
      }
    },
    "operationsNetworkSecurityGroupDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Diagnostic Metrics to enable for the Operations Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "sharedServicesVirtualNetworkDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Logs to enable for the SharedServices Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#logs for valid settings."
      }
    },
    "sharedServicesVirtualNetworkDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Diagnostic Metrics to enable for the SharedServices Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "sharedServicesNetworkSecurityGroupRules": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group rules to apply to the SharedServices Virtual Network. See https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups/securityrules?tabs=bicep#securityrulepropertiesformat for valid settings."
      }
    },
    "sharedServicesNetworkSecurityGroupDiagnosticsLogs": {
      "type": "array",
      "defaultValue": [
        {
          "category": "NetworkSecurityGroupEvent",
          "enabled": true
        },
        {
          "category": "NetworkSecurityGroupRuleCounter",
          "enabled": true
        }
      ],
      "metadata": {
        "description": "An array of Network Security Group diagnostic logs to apply to the SharedServices Virtual Network. See https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-nsg-manage-log#log-categories for valid settings."
      }
    },
    "sharedServicesNetworkSecurityGroupDiagnosticsMetrics": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "An array of Network Security Group Diagnostic Metrics to enable for the SharedServices Virtual Network. See https://docs.microsoft.com/en-us/azure/azure-monitor/essentials/diagnostic-settings?tabs=CMD#metrics for valid settings."
      }
    },
    "deploySentinel": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", enables Microsoft Sentinel within the Log Analytics Workspace created in this deployment. It defaults to \"false\"."
      }
    },
    "logAnalyticsWorkspaceCappingDailyQuotaGb": {
      "type": "int",
      "defaultValue": -1,
      "metadata": {
        "description": "The daily quota for Log Analytics Workspace logs in Gigabytes. It defaults to \"-1\" for no quota."
      }
    },
    "logAnalyticsWorkspaceNoSentinelRetentionInDays": {
      "type": "int",
      "defaultValue": 30,
      "metadata": {
        "description": "The number of days to retain Log Analytics Workspace logs without Sentinel. It defaults to \"30\"."
      }
    },
    "logAnalyticsSentinelWorkspaceRetentionInDays": {
      "type": "int",
      "defaultValue": 90,
      "metadata": {
        "description": "The number of days to retain logs in Sentinel-linked Workspace. It defaults to \"90\"."
      }
    },
    "logAnalyticsWorkspaceSkuName": {
      "type": "string",
      "defaultValue": "PerGB2018",
      "allowedValues": [
        "Free",
        "Standard",
        "Premium",
        "PerNode",
        "PerGB2018",
        "Standalone"
      ],
      "metadata": {
        "description": "[Free/Standard/Premium/PerNode/PerGB2018/Standalone] The SKU for the Log Analytics Workspace. It defaults to \"PerGB2018\". See https://docs.microsoft.com/en-us/azure/azure-monitor/logs/resource-manager-workspace for valid settings."
      }
    },
    "logStorageSkuName": {
      "type": "string",
      "defaultValue": "Standard_GRS",
      "metadata": {
        "description": "The Storage Account SKU to use for log storage. It defaults to \"Standard_GRS\". See https://docs.microsoft.com/en-us/rest/api/storagerp/srp_sku_types for valid settings."
      }
    },
    "deployBastion": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", provisions Azure Bastion Host only. It defaults to \"false\"."
      }
    },
    "deployAzureGatewaySubnet": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", provisions Azure Gateway Subnet only. It defaults to \"false\"."
      }
    },
    "deployWindowsVirtualMachine": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", provisions Windows Virtual Machine Host only. It defaults to \"false\"."
      }
    },
    "deployLinuxVirtualMachine": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", provisions Linux Virtual Machine Host only. It defaults to \"false\"."
      }
    },
    "bastionHostSubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.128.192/26",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the Azure Bastion Subnet. It must be in the Hub Virtual Network space \"hubVirtualNetworkAddressPrefix\" parameter value. It must be /27 or larger."
      }
    },
    "azureGatewaySubnetAddressPrefix": {
      "type": "string",
      "defaultValue": "10.0.129.192/26",
      "metadata": {
        "description": "The CIDR Subnet Address Prefix for the Azure Gateway Subnet. It must be in the Hub Virtual Network space. It must be /26."
      }
    },
    "bastionHostPublicIPAddressAvailabilityZones": {
      "type": "array",
      "defaultValue": [],
      "metadata": {
        "description": "The Azure Bastion Public IP Address Availability Zones. It defaults to \"No-Zone\" because Availability Zones are not available in every cloud. See https://docs.microsoft.com/en-us/azure/virtual-network/ip-services/public-ip-addresses#sku for valid settings."
      }
    },
    "hybridUseBenefit": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "The hybrid use benefit provides a discount on virtual machines when a customer has an on-premises Windows Server license with Software Assurance."
      }
    },
    "linuxVmAdminUsername": {
      "type": "string",
      "defaultValue": "azureuser",
      "metadata": {
        "description": "The administrator username for the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"azureuser\"."
      }
    },
    "linuxVmAuthenticationType": {
      "type": "string",
      "defaultValue": "password",
      "allowedValues": [
        "sshPublicKey",
        "password"
      ],
      "metadata": {
        "description": "[sshPublicKey/password] The authentication type for the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"password\"."
      }
    },
    "linuxVmAdminPasswordOrKey": {
      "type": "securestring",
      "defaultValue": "[if(parameters('deployLinuxVirtualMachine'), '', newGuid())]",
      "minLength": 12,
      "metadata": {
        "description": "The administrator password or public SSH key for the Linux Virtual Machine to Azure Bastion remote into. See https://docs.microsoft.com/en-us/azure/virtual-machines/linux/faq#what-are-the-password-requirements-when-creating-a-vm- for password requirements."
      }
    },
    "linuxVmSize": {
      "type": "string",
      "defaultValue": "Standard_B2s",
      "metadata": {
        "description": "The size of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"Standard_B2s\"."
      }
    },
    "linuxVmOsDiskCreateOption": {
      "type": "string",
      "defaultValue": "FromImage",
      "metadata": {
        "description": "The disk creation option of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"FromImage\"."
      }
    },
    "linuxVmOsDiskType": {
      "type": "string",
      "defaultValue": "Standard_LRS",
      "metadata": {
        "description": "The disk type of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"Standard_LRS\"."
      }
    },
    "linuxVmImagePublisher": {
      "type": "string",
      "defaultValue": "Canonical",
      "metadata": {
        "description": "The image publisher of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"Canonical\"."
      }
    },
    "linuxVmImageOffer": {
      "type": "string",
      "defaultValue": "0001-com-ubuntu-server-focal",
      "metadata": {
        "description": "The image offer of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"UbuntuServer\"."
      }
    },
    "linuxVmImageSku": {
      "type": "string",
      "defaultValue": "20_04-lts-gen2",
      "metadata": {
        "description": "The image SKU of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"18.04-LTS\"."
      }
    },
    "linuxVmImageVersion": {
      "type": "string",
      "defaultValue": "latest",
      "metadata": {
        "description": "The image version of the Linux Virtual Machine to Azure Bastion remote into. It defaults to \"latest\"."
      }
    },
    "linuxNetworkInterfacePrivateIPAddressAllocationMethod": {
      "type": "string",
      "defaultValue": "Dynamic",
      "allowedValues": [
        "Static",
        "Dynamic"
      ],
      "metadata": {
        "description": "[Static/Dynamic] The public IP Address allocation method for the Linux virtual machine. It defaults to \"Dynamic\"."
      }
    },
    "windowsVmAdminUsername": {
      "type": "string",
      "defaultValue": "azureuser",
      "metadata": {
        "description": "The administrator username for the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"azureuser\"."
      }
    },
    "windowsVmAdminPassword": {
      "type": "securestring",
      "defaultValue": "[if(parameters('deployWindowsVirtualMachine'), '', newGuid())]",
      "minLength": 12,
      "metadata": {
        "description": "The administrator password the Windows Virtual Machine to Azure Bastion remote into. It must be > 12 characters in length. See https://docs.microsoft.com/en-us/azure/virtual-machines/windows/faq#what-are-the-password-requirements-when-creating-a-vm- for password requirements."
      }
    },
    "windowsVmSize": {
      "type": "string",
      "defaultValue": "Standard_DS1_v2",
      "metadata": {
        "description": "The size of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"Standard_DS1_v2\"."
      }
    },
    "windowsVmPublisher": {
      "type": "string",
      "defaultValue": "MicrosoftWindowsServer",
      "metadata": {
        "description": "The publisher of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"MicrosoftWindowsServer\"."
      }
    },
    "windowsVmOffer": {
      "type": "string",
      "defaultValue": "WindowsServer",
      "metadata": {
        "description": "The offer of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"WindowsServer\"."
      }
    },
    "windowsVmSku": {
      "type": "string",
      "defaultValue": "2019-datacenter-gensecond",
      "metadata": {
        "description": "The SKU of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"2019-datacenter\"."
      }
    },
    "windowsVmVersion": {
      "type": "string",
      "defaultValue": "latest",
      "metadata": {
        "description": "The version of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"latest\"."
      }
    },
    "windowsVmCreateOption": {
      "type": "string",
      "defaultValue": "FromImage",
      "metadata": {
        "description": "The disk creation option of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"FromImage\"."
      }
    },
    "windowsVmStorageAccountType": {
      "type": "string",
      "defaultValue": "StandardSSD_LRS",
      "metadata": {
        "description": "The storage account type of the Windows Virtual Machine to Azure Bastion remote into. It defaults to \"StandardSSD_LRS\"."
      }
    },
    "windowsNetworkInterfacePrivateIPAddressAllocationMethod": {
      "type": "string",
      "defaultValue": "Dynamic",
      "allowedValues": [
        "Static",
        "Dynamic"
      ],
      "metadata": {
        "description": "[Static/Dynamic] The public IP Address allocation method for the Windows virtual machine. It defaults to \"Dynamic\"."
      }
    },
    "deployPolicy": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "When set to \"true\", deploys the Azure Policy set defined at by the parameter \"policy\" to the resource groups generated in the deployment. It defaults to \"false\"."
      }
    },
    "policy": {
      "type": "string",
      "defaultValue": "NISTRev4",
      "allowedValues": [
        "NISTRev4",
        "NISTRev5",
        "IL5",
        "CMMC"
      ],
      "metadata": {
        "description": "[NISTRev4/NISTRev5/IL5/CMMC] Built-in policy assignments to assign, it defaults to \"NISTRev4\". IL5 is only available for AzureUsGovernment and will switch to NISTRev4 if tried in AzureCloud."
      }
    },
    "deployDefender": {
      "type": "bool",
      "defaultValue": true,
      "metadata": {
        "description": "When set to \"true\", enables Microsoft Defender for Cloud for the subscriptions used in the deployment. It defaults to \"false\"."
      }
    },
    "defenderSkuTier": {
      "type": "string",
      "defaultValue": "Free",
      "allowedValues": [
        "Standard",
        "Free"
      ],
      "metadata": {
        "description": "[Standard/Free] The SKU for Defender. It defaults to \"Free\"."
      }
    },
    "emailSecurityContact": {
      "type": "string",
      "defaultValue": "",
      "metadata": {
        "description": "Email address of the contact, in the form of john@doe.com"
      }
    },
    "deployDefenderPlans": {
      "type": "array",
      "defaultValue": [
        "VirtualMachines"
      ],
      "metadata": {
        "description": "Paid Workload Protection plans for Defender for Cloud"
      }
    }
  },
  "variables": {
    "copy": [
      {
        "name": "firewallClientUsableIpAddresses",
        "count": "[length(range(0, 4))]",
        "input": "[cidrHost(parameters('firewallClientSubnetAddressPrefix'), range(0, 4)[copyIndex('firewallClientUsableIpAddresses')])]"
      }
    ],
    "firewallClientPrivateIpAddress": "[variables('firewallClientUsableIpAddresses')[3]]",
    "logAnalyticsWorkspaceRetentionInDays": "[if(parameters('deploySentinel'), parameters('logAnalyticsSentinelWorkspaceRetentionInDays'), parameters('logAnalyticsWorkspaceNoSentinelRetentionInDays'))]",
    "networks": "[union(createArray(createObject('name', 'hub', 'shortName', 'hub', 'deployUniqueResources', true(), 'subscriptionId', parameters('hubSubscriptionId'), 'nsgDiagLogs', parameters('hubNetworkSecurityGroupDiagnosticsLogs'), 'nsgDiagMetrics', parameters('hubNetworkSecurityGroupDiagnosticsMetrics'), 'nsgRules', parameters('hubNetworkSecurityGroupRules'), 'vnetAddressPrefix', parameters('hubVirtualNetworkAddressPrefix'), 'vnetDiagLogs', parameters('hubVirtualNetworkDiagnosticsLogs'), 'vnetDiagMetrics', parameters('hubVirtualNetworkDiagnosticsMetrics'), 'subnetAddressPrefix', parameters('hubSubnetAddressPrefix')), createObject('name', 'operations', 'shortName', 'ops', 'deployUniqueResources', if(contains(createArray(parameters('hubSubscriptionId')), parameters('operationsSubscriptionId')), false(), true()), 'subscriptionId', parameters('operationsSubscriptionId'), 'nsgDiagLogs', parameters('operationsNetworkSecurityGroupDiagnosticsLogs'), 'nsgDiagMetrics', parameters('operationsNetworkSecurityGroupDiagnosticsMetrics'), 'nsgRules', parameters('operationsNetworkSecurityGroupRules'), 'vnetAddressPrefix', parameters('operationsVirtualNetworkAddressPrefix'), 'vnetDiagLogs', parameters('operationsVirtualNetworkDiagnosticsLogs'), 'vnetDiagMetrics', parameters('operationsVirtualNetworkDiagnosticsMetrics'), 'subnetAddressPrefix', parameters('operationsSubnetAddressPrefix')), createObject('name', 'sharedServices', 'shortName', 'svcs', 'deployUniqueResources', if(contains(createArray(parameters('hubSubscriptionId'), parameters('operationsSubscriptionId')), parameters('sharedServicesSubscriptionId')), false(), true()), 'subscriptionId', parameters('sharedServicesSubscriptionId'), 'nsgDiagLogs', parameters('sharedServicesNetworkSecurityGroupDiagnosticsLogs'), 'nsgDiagMetrics', parameters('sharedServicesNetworkSecurityGroupDiagnosticsMetrics'), 'nsgRules', parameters('sharedServicesNetworkSecurityGroupRules'), 'vnetAddressPrefix', parameters('sharedServicesVirtualNetworkAddressPrefix'), 'vnetDiagLogs', parameters('sharedServicesVirtualNetworkDiagnosticsLogs'), 'vnetDiagMetrics', parameters('sharedServicesVirtualNetworkDiagnosticsMetrics'), 'subnetAddressPrefix', parameters('sharedServicesSubnetAddressPrefix'))), if(parameters('deployIdentity'), createArray(createObject('name', 'identity', 'shortName', 'id', 'deployUniqueResources', if(contains(createArray(parameters('hubSubscriptionId'), parameters('operationsSubscriptionId'), parameters('sharedServicesSubscriptionId')), parameters('identitySubscriptionId')), false(), true()), 'subscriptionId', parameters('identitySubscriptionId'), 'nsgDiagLogs', parameters('identityNetworkSecurityGroupDiagnosticsLogs'), 'nsgDiagMetrics', parameters('identityNetworkSecurityGroupDiagnosticsMetrics'), 'nsgRules', parameters('identityNetworkSecurityGroupRules'), 'vnetAddressPrefix', parameters('identityVirtualNetworkAddressPrefix'), 'vnetDiagLogs', parameters('identityVirtualNetworkDiagnosticsLogs'), 'vnetDiagMetrics', parameters('identityVirtualNetworkDiagnosticsMetrics'), 'subnetAddressPrefix', parameters('identitySubnetAddressPrefix'))), createArray()))]"
  },
  "resources": [
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('get-logic-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "environmentAbbreviation": {
            "value": "[parameters('environmentAbbreviation')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "networks": {
            "value": "[variables('networks')]"
          },
          "resourcePrefix": {
            "value": "[parameters('resourcePrefix')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "17624108366935160596"
            }
          },
          "parameters": {
            "deploymentNameSuffix": {
              "type": "string"
            },
            "environmentAbbreviation": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "networks": {
              "type": "array"
            },
            "resourcePrefix": {
              "type": "string"
            },
            "stampIndex": {
              "type": "string",
              "defaultValue": ""
            }
          },
          "variables": {
            "copy": [
              {
                "name": "privateDnsZoneNames_Backup",
                "count": "[length(items(variables('locations')))]",
                "input": "[format('privatelink.{0}.backup.windowsazure.{1}', items(variables('locations'))[copyIndex('privateDnsZoneNames_Backup')].value.recoveryServicesGeo, coalesce(variables('privateDnsZoneSuffixes_Backup')[environment().name], variables('cloudSuffix')))]"
              }
            ],
            "$fxv#0": {
              "AzureChina": {
                "chinaeast": {
                  "abbreviation": "cne",
                  "recoveryServicesGeo": "sha",
                  "timeDifference": "+8:00",
                  "timeZone": "China Standard Time"
                },
                "chinaeast2": {
                  "abbreviation": "cne2",
                  "recoveryServicesGeo": "sha2",
                  "timeDifference": "+8:00",
                  "timeZone": "China Standard Time"
                },
                "chinanorth": {
                  "abbreviation": "cnn",
                  "recoveryServicesGeo": "bjb",
                  "timeDifference": "+8:00",
                  "timeZone": "China Standard Time"
                },
                "chinanorth2": {
                  "abbreviation": "cnn2",
                  "recoveryServicesGeo": "bjb2",
                  "timeDifference": "+8:00",
                  "timeZone": "China Standard Time"
                }
              },
              "AzureCloud": {
                "australiacentral": {
                  "abbreviation": "auc",
                  "recoveryServicesGeo": "acl",
                  "timeDifference": "+10:00",
                  "timeZone": "AUS Eastern Standard Time"
                },
                "australiacentral2": {
                  "abbreviation": "auc2",
                  "recoveryServicesGeo": "acl2",
                  "timeDifference": "+10:00",
                  "timeZone": "AUS Eastern Standard Time"
                },
                "australiaeast": {
                  "abbreviation": "aue",
                  "recoveryServicesGeo": "ae",
                  "timeDifference": "+10:00",
                  "timeZone": "AUS Eastern Standard Time"
                },
                "australiasoutheast": {
                  "abbreviation": "ause",
                  "recoveryServicesGeo": "ase",
                  "timeDifference": "+10:00",
                  "timeZone": "AUS Eastern Standard Time"
                },
                "brazilsouth": {
                  "abbreviation": "brs",
                  "recoveryServicesGeo": "brs",
                  "timeDifference": "-3:00",
                  "timeZone": "E. South America Standard Time"
                },
                "brazilsoutheast": {
                  "abbreviation": "brse",
                  "recoveryServicesGeo": "bse",
                  "timeDifference": "-3:00",
                  "timeZone": "E. South America Standard Time"
                },
                "canadacentral": {
                  "abbreviation": "cac",
                  "recoveryServicesGeo": "cnc",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "canadaeast": {
                  "abbreviation": "cae",
                  "recoveryServicesGeo": "cne",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "centralindia": {
                  "abbreviation": "inc",
                  "recoveryServicesGeo": "inc",
                  "timeDifference": "+5:30",
                  "timeZone": "India Standard Time"
                },
                "centralus": {
                  "abbreviation": "usc",
                  "recoveryServicesGeo": "cus",
                  "timeDifference": "-6:00",
                  "timeZone": "Central Standard Time"
                },
                "eastasia": {
                  "abbreviation": "ase",
                  "recoveryServicesGeo": "ea",
                  "timeDifference": "+8:00",
                  "timeZone": "China Standard Time"
                },
                "eastus": {
                  "abbreviation": "use",
                  "recoveryServicesGeo": "eus",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "eastus2": {
                  "abbreviation": "use2",
                  "recoveryServicesGeo": "eus2",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "francecentral": {
                  "abbreviation": "frc",
                  "recoveryServicesGeo": "frc",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "francesouth": {
                  "abbreviation": "frs",
                  "recoveryServicesGeo": "frs",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "germanynorth": {
                  "abbreviation": "den",
                  "recoveryServicesGeo": "gn",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "germanywestcentral": {
                  "abbreviation": "dewc",
                  "recoveryServicesGeo": "gwc",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "israelcentral": {
                  "abbreviation": "ilc",
                  "recoveryServicesGeo": "ilc",
                  "timeDifference": "+2:00",
                  "timeZone": "Israel Standard Time"
                },
                "italynorth": {
                  "abbreviation": "itn",
                  "recoveryServicesGeo": "itn",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "japaneast": {
                  "abbreviation": "jpe",
                  "recoveryServicesGeo": "jpe",
                  "timeDifference": "+9:00",
                  "timeZone": "Tokyo Standard Time"
                },
                "japanwest": {
                  "abbreviation": "jpw",
                  "recoveryServicesGeo": "jpw",
                  "timeDifference": "+9:00",
                  "timeZone": "Tokyo Standard Time"
                },
                "jioindiacentral": {
                  "abbreviation": "injc",
                  "recoveryServicesGeo": "jic",
                  "timeDifference": "+5:30",
                  "timeZone": "India Standard Time"
                },
                "jioindiawest": {
                  "abbreviation": "injw",
                  "recoveryServicesGeo": "jiw",
                  "timeDifference": "+5:30",
                  "timeZone": "India Standard Time"
                },
                "koreacentral": {
                  "abbreviation": "krc",
                  "recoveryServicesGeo": "krc",
                  "timeDifference": "+9:00",
                  "timeZone": "Korea Standard Time"
                },
                "koreasouth": {
                  "abbreviation": "krs",
                  "recoveryServicesGeo": "krs",
                  "timeDifference": "+9:00",
                  "timeZone": "Korea Standard Time"
                },
                "northcentralus": {
                  "abbreviation": "usnc",
                  "recoveryServicesGeo": "ncus",
                  "timeDifference": "-6:00",
                  "timeZone": "Central Standard Time"
                },
                "northeurope": {
                  "abbreviation": "eun",
                  "recoveryServicesGeo": "ne",
                  "timeDifference": "0:00",
                  "timeZone": "GMT Standard Time"
                },
                "norwayeast": {
                  "abbreviation": "noe",
                  "recoveryServicesGeo": "nwe",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "norwaywest": {
                  "abbreviation": "now",
                  "recoveryServicesGeo": "nww",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "polandcentral": {
                  "abbreviation": "plc",
                  "recoveryServicesGeo": "plc",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "qatarcentral": {
                  "abbreviation": "qac",
                  "recoveryServicesGeo": "qac",
                  "timeDifference": "+3:00",
                  "timeZone": "Arabian Standard Time"
                },
                "southafricanorth": {
                  "abbreviation": "zan",
                  "recoveryServicesGeo": "san",
                  "timeDifference": "+2:00",
                  "timeZone": "South Africa Standard Time"
                },
                "southafricawest": {
                  "abbreviation": "zaw",
                  "recoveryServicesGeo": "saw",
                  "timeDifference": "+2:00",
                  "timeZone": "South Africa Standard Time"
                },
                "southcentralus": {
                  "abbreviation": "ussc",
                  "recoveryServicesGeo": "scus",
                  "timeDifference": "-6:00",
                  "timeZone": "Central Standard Time"
                },
                "southeastasia": {
                  "abbreviation": "asse",
                  "recoveryServicesGeo": "sea",
                  "timeDifference": "+8:00",
                  "timeZone": "Singapore Standard Time"
                },
                "southindia": {
                  "abbreviation": "ins",
                  "recoveryServicesGeo": "ins",
                  "timeDifference": "+5:30",
                  "timeZone": "India Standard Time"
                },
                "swedencentral": {
                  "abbreviation": "sec",
                  "recoveryServicesGeo": "sdc",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "switzerlandnorth": {
                  "abbreviation": "chn",
                  "recoveryServicesGeo": "szn",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "switzerlandwest": {
                  "abbreviation": "chw",
                  "recoveryServicesGeo": "szw",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "uaecentral": {
                  "abbreviation": "aec",
                  "recoveryServicesGeo": "uac",
                  "timeDifference": "+3:00",
                  "timeZone": "Arabian Standard Time"
                },
                "uaenorth": {
                  "abbreviation": "aen",
                  "recoveryServicesGeo": "uan",
                  "timeDifference": "+3:00",
                  "timeZone": "Arabian Standard Time"
                },
                "uksouth": {
                  "abbreviation": "uks",
                  "recoveryServicesGeo": "uks",
                  "timeDifference": "0:00",
                  "timeZone": "GMT Standard Time"
                },
                "ukwest": {
                  "abbreviation": "ukw",
                  "recoveryServicesGeo": "ukw",
                  "timeDifference": "0:00",
                  "timeZone": "GMT Standard Time"
                },
                "westcentralus": {
                  "abbreviation": "uswc",
                  "recoveryServicesGeo": "wcus",
                  "timeDifference": "-7:00",
                  "timeZone": "Mountain Standard Time"
                },
                "westeurope": {
                  "abbreviation": "euw",
                  "recoveryServicesGeo": "we",
                  "timeDifference": "+1:00",
                  "timeZone": "Central Europe Standard Time"
                },
                "westindia": {
                  "abbreviation": "inw",
                  "recoveryServicesGeo": "inw",
                  "timeDifference": "+5:30",
                  "timeZone": "India Standard Time"
                },
                "westus": {
                  "abbreviation": "usw",
                  "recoveryServicesGeo": "wus",
                  "timeDifference": "-8:00",
                  "timeZone": "Pacific Standard Time"
                },
                "westus2": {
                  "abbreviation": "usw2",
                  "recoveryServicesGeo": "wus2",
                  "timeDifference": "-8:00",
                  "timeZone": "Pacific Standard Time"
                },
                "westus3": {
                  "abbreviation": "usw3",
                  "recoveryServicesGeo": "wus3",
                  "timeDifference": "-7:00",
                  "timeZone": "Mountain Standard Time"
                }
              },
              "AzureUSGovernment": {
                "usdodcentral": {
                  "abbreviation": "dodc",
                  "recoveryServicesGeo": "udc",
                  "timeDifference": "-6:00",
                  "timeZone": "Central Standard Time"
                },
                "usdodeast": {
                  "abbreviation": "dode",
                  "recoveryServicesGeo": "ude",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "usgovarizona": {
                  "abbreviation": "az",
                  "recoveryServicesGeo": "uga",
                  "timeDifference": "-7:00",
                  "timeZone": "Mountain Standard Time"
                },
                "usgovtexas": {
                  "abbreviation": "tx",
                  "recoveryServicesGeo": "ugt",
                  "timeDifference": "-6:00",
                  "timeZone": "Central Standard Time"
                },
                "usgovvirginia": {
                  "abbreviation": "va",
                  "recoveryServicesGeo": "ugv",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                }
              },
              "USNat": {
                "usnateast": {
                  "abbreviation": "east",
                  "recoveryServicesGeo": "exe",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "usnatwest": {
                  "abbreviation": "west",
                  "recoveryServicesGeo": "exw",
                  "timeDifference": "-8:00",
                  "timeZone": "Pacific Standard Time"
                }
              },
              "USSec": {
                "usseceast": {
                  "abbreviation": "east",
                  "recoveryServicesGeo": "rxe",
                  "timeDifference": "-5:00",
                  "timeZone": "Eastern Standard Time"
                },
                "ussecwest": {
                  "abbreviation": "west",
                  "recoveryServicesGeo": "rxw",
                  "timeDifference": "-8:00",
                  "timeZone": "Pacific Standard Time"
                }
              }
            },
            "$fxv#1": "1.0.0",
            "$fxv#2": {
              "actionGroups": "ag",
              "applicationGroups": "vdag",
              "automationAccounts": "aa",
              "availabilitySets": "avail",
              "azureFirewalls": "afw",
              "bastionHosts": "bas",
              "computeGallieries": "cg",
              "dataCollectionRuleAssociations": "dcra",
              "dataCollectionRules": "dcr",
              "diagnosticSettings": "diag",
              "diskAccesses": "da",
              "diskEncryptionSets": "des",
              "disks": "disk",
              "firewallPolicies": "afwp",
              "hostPools": "vdpool",
              "ipConfigurations": "ipconf",
              "keyVaults": "kv",
              "logAnalyticsWorkspaces": "log",
              "netAppAccounts": "naa",
              "netAppCapacityPools": "nacp",
              "networkInterfaces": "nic",
              "networkSecurityGroups": "nsg",
              "networkWatchers": "nw",
              "privateEndpoints": "pe",
              "privateLinkScopes": "pls",
              "publicIPAddresses": "pip",
              "recoveryServicesVaults": "rsv",
              "remoteApplicationGroups": "vdag",
              "resourceGroups": "rg",
              "routeTables": "rt",
              "storageAccounts": "st",
              "subnets": "snet",
              "userAssignedIdentities": "id",
              "virtualMachines": "vm",
              "virtualNetworks": "vnet",
              "workspaces": "vdws"
            },
            "cloudSuffix": "[replace(replace(environment().resourceManager, 'https://management.', ''), '/', '')]",
            "environmentName": {
              "dev": "Development",
              "prod": "Production",
              "test": "Test"
            },
            "locations": "[variables('$fxv#0')[environment().name]]",
            "mlzTags": {
              "environment": "[variables('environmentName')[parameters('environmentAbbreviation')]]",
              "landingZoneName": "MissionLandingZone",
              "landingZoneVersion": "[variables('$fxv#1')]",
              "resourcePrefix": "[parameters('resourcePrefix')]"
            },
            "resourceAbbreviations": "[variables('$fxv#2')]",
            "tokens": {
              "resource": "resource_token",
              "service": "service_token"
            },
            "privateDnsZoneNames": "[union(createArray(format('privatelink.agentsvc.azure-automation.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureAutomation')[environment().name], variables('cloudSuffix'))), format('privatelink.azure-automation.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureAutomation')[environment().name], variables('cloudSuffix'))), format('privatelink.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureWebSites')[environment().name], format('appservice.{0}', variables('cloudSuffix')))), format('scm.privatelink.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureWebSites')[environment().name], format('appservice.{0}', variables('cloudSuffix')))), format('privatelink.wvd.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureVirtualDesktop')[environment().name], variables('cloudSuffix'))), format('privatelink-global.wvd.{0}', coalesce(variables('privateDnsZoneSuffixes_AzureVirtualDesktop')[environment().name], variables('cloudSuffix'))), format('privatelink.file.{0}', environment().suffixes.storage), format('privatelink.queue.{0}', environment().suffixes.storage), format('privatelink.table.{0}', environment().suffixes.storage), format('privatelink.blob.{0}', environment().suffixes.storage), format('privatelink{0}', replace(environment().suffixes.keyvaultDns, 'vault', 'vaultcore')), format('privatelink.monitor.{0}', coalesce(variables('privateDnsZoneSuffixes_Monitor')[environment().name], variables('cloudSuffix'))), format('privatelink.ods.opinsights.{0}', coalesce(variables('privateDnsZoneSuffixes_Monitor')[environment().name], variables('cloudSuffix'))), format('privatelink.oms.opinsights.{0}', coalesce(variables('privateDnsZoneSuffixes_Monitor')[environment().name], variables('cloudSuffix')))), variables('privateDnsZoneNames_Backup'))]",
            "privateDnsZoneSuffixes_AzureAutomation": {
              "AzureCloud": "net",
              "AzureUSGovernment": "us",
              "USNat": null,
              "USSec": null
            },
            "privateDnsZoneSuffixes_AzureVirtualDesktop": {
              "AzureCloud": "microsoft.com",
              "AzureUSGovernment": "azure.us",
              "USNat": null,
              "USSec": null
            },
            "privateDnsZoneSuffixes_AzureWebSites": {
              "AzureCloud": "azurewebsites.net",
              "AzureUSGovernment": "azurewebsites.us",
              "USNat": null,
              "USSec": null
            },
            "privateDnsZoneSuffixes_Backup": {
              "AzureCloud": "com",
              "AzureUSGovernment": "us",
              "USNat": null,
              "USSec": null
            },
            "privateDnsZoneSuffixes_Monitor": {
              "AzureCloud": "azure.com",
              "AzureUSGovernment": "azure.us",
              "USNat": null,
              "USSec": null
            }
          },
          "resources": [
            {
              "copy": {
                "name": "namingConventions",
                "count": "[length(parameters('networks'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('naming-convention-{0}-{1}', parameters('networks')[copyIndex()].shortName, parameters('deploymentNameSuffix'))]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "locationAbbreviation": {
                    "value": "[variables('locations')[parameters('location')].abbreviation]"
                  },
                  "environmentAbbreviation": {
                    "value": "[parameters('environmentAbbreviation')]"
                  },
                  "networkName": {
                    "value": "[parameters('networks')[copyIndex()].name]"
                  },
                  "networkShortName": {
                    "value": "[parameters('networks')[copyIndex()].shortName]"
                  },
                  "resourceAbbreviations": {
                    "value": "[variables('resourceAbbreviations')]"
                  },
                  "resourcePrefix": {
                    "value": "[parameters('resourcePrefix')]"
                  },
                  "stampIndex": {
                    "value": "[parameters('stampIndex')]"
                  },
                  "subscriptionId": {
                    "value": "[parameters('networks')[copyIndex()].subscriptionId]"
                  },
                  "tokens": {
                    "value": "[variables('tokens')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "5685452971915623928"
                    }
                  },
                  "parameters": {
                    "environmentAbbreviation": {
                      "type": "string"
                    },
                    "locationAbbreviation": {
                      "type": "string"
                    },
                    "networkName": {
                      "type": "string"
                    },
                    "networkShortName": {
                      "type": "string"
                    },
                    "resourceAbbreviations": {
                      "type": "object"
                    },
                    "resourcePrefix": {
                      "type": "string"
                    },
                    "stampIndex": {
                      "type": "string",
                      "defaultValue": ""
                    },
                    "subscriptionId": {
                      "type": "string"
                    },
                    "tokens": {
                      "type": "object"
                    }
                  },
                  "variables": {
                    "namingConvention": "[format('{0}-{1}{2}-{3}-{4}-{5}', toLower(parameters('resourcePrefix')), if(empty(parameters('stampIndex')), '', format('{0}-', parameters('stampIndex'))), parameters('tokens').resource, parameters('networkName'), parameters('environmentAbbreviation'), parameters('locationAbbreviation'))]",
                    "namingConvention_Service": "[format('{0}-{1}{2}-{3}-{4}-{5}-{6}', toLower(parameters('resourcePrefix')), if(empty(parameters('stampIndex')), '', format('{0}-', parameters('stampIndex'))), parameters('tokens').resource, parameters('tokens').service, parameters('networkName'), parameters('environmentAbbreviation'), parameters('locationAbbreviation'))]",
                    "names": {
                      "actionGroup": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').actionGroups)]",
                      "applicationGroup": "[replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').applicationGroups)]",
                      "automationAccount": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').automationAccounts)]",
                      "automationAccountDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').automationAccounts)]",
                      "automationAccountNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, parameters('resourceAbbreviations').automationAccounts)]",
                      "automationAccountPrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, parameters('resourceAbbreviations').automationAccounts)]",
                      "availabilitySet": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').availabilitySets)]",
                      "azureFirewall": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').azureFirewalls)]",
                      "azureFirewallClientPublicIPAddress": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').publicIpAddresses), parameters('tokens').service, format('client-{0}', parameters('resourceAbbreviations').azureFirewalls))]",
                      "azureFirewallClientPublicIPAddressDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}-client-{1}', parameters('resourceAbbreviations').publicIpAddresses, parameters('resourceAbbreviations').azureFirewalls))]",
                      "azureFirewallDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').azureFirewalls)]",
                      "azureFirewallManagementPublicIPAddress": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').publicIpAddresses), parameters('tokens').service, format('mgmt-{0}', parameters('resourceAbbreviations').azureFirewalls))]",
                      "azureFirewallManagementPublicIPAddressDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}-mgmt-{1}', parameters('resourceAbbreviations').publicIpAddresses, parameters('resourceAbbreviations').azureFirewalls))]",
                      "azureFirewallPolicy": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').firewallPolicies)]",
                      "bastionHost": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').bastionHosts)]",
                      "bastionHostNetworkSecurityGroup": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkSecurityGroups), parameters('tokens').service, parameters('resourceAbbreviations').bastionHosts)]",
                      "bastionHostDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').bastionHosts)]",
                      "bastionHostPublicIPAddress": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').publicIpAddresses), parameters('tokens').service, parameters('resourceAbbreviations').bastionHosts)]",
                      "bastionHostPublicIPAddressDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}-{1}', parameters('resourceAbbreviations').publicIpAddresses, parameters('resourceAbbreviations').bastionHosts))]",
                      "computeGallery": "[replace(replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').computeGallieries), '-', '_')]",
                      "dataCollectionRuleAssociation": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').dataCollectionRuleAssociations)]",
                      "dataCollectionRule": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').dataCollectionRules)]",
                      "diskAccess": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').diskAccesses)]",
                      "diskEncryptionSet": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').diskEncryptionSets)]",
                      "hostPool": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').hostPools)]",
                      "hostPoolDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').hostPools)]",
                      "hostPoolNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, parameters('resourceAbbreviations').hostPools)]",
                      "hostPoolPrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, parameters('resourceAbbreviations').hostPools)]",
                      "keyVault": "[format('{0}{1}', replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').keyVaults), '-', ''), parameters('networkName'), parameters('networkShortName')), uniqueString(parameters('resourcePrefix'), parameters('environmentAbbreviation'), parameters('subscriptionId')))]",
                      "keyVaultDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}{1}', parameters('tokens').service, parameters('resourceAbbreviations').keyVaults))]",
                      "keyVaultNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, format('{0}{1}', parameters('tokens').service, parameters('resourceAbbreviations').keyVaults))]",
                      "keyVaultPrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, format('{0}{1}', parameters('tokens').service, parameters('resourceAbbreviations').keyVaults))]",
                      "logAnalyticsWorkspace": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').logAnalyticsWorkspaces)]",
                      "logAnalyticsWorkspaceDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').logAnalyticsWorkspaces)]",
                      "netAppAccountCapacityPool": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').netAppCapacityPools)]",
                      "netAppAccount": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').netAppAccounts)]",
                      "networkSecurityGroup": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').networkSecurityGroups)]",
                      "networkSecurityGroupDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').networkSecurityGroups)]",
                      "networkWatcher": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').networkWatchers)]",
                      "privateLinkScope": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').privateLinkScopes)]",
                      "privateLinkScopeNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, parameters('resourceAbbreviations').privateLinkScopes)]",
                      "privateLinkScopePrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, parameters('resourceAbbreviations').privateLinkScopes)]",
                      "recoveryServicesVault": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').recoveryServicesVaults)]",
                      "recoveryServicesVaultNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, parameters('resourceAbbreviations').recoveryServicesVaults)]",
                      "recoveryServicesVaultPrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, parameters('resourceAbbreviations').recoveryServicesVaults)]",
                      "resourceGroup": "[replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').resourceGroups)]",
                      "routeTable": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').routeTables)]",
                      "storageAccount": "[toLower(replace(replace(replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').storageAccounts), parameters('networkName'), parameters('networkShortName')), '-', ''))]",
                      "storageAccountNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').storageAccounts))]",
                      "storageAccountPrivateEndpoint": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').storageAccounts))]",
                      "subnet": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').subnets)]",
                      "userAssignedIdentity": "[replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').userAssignedIdentities)]",
                      "virtualMachine": "[replace(replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').virtualMachines), parameters('environmentAbbreviation'), first(parameters('environmentAbbreviation'))), parameters('networkName'), ''), '-', '')]",
                      "virtualMachineDisk": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').disks), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').virtualMachines))]",
                      "virtualMachineNetworkInterface": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').virtualMachines))]",
                      "virtualNetwork": "[replace(variables('namingConvention'), parameters('tokens').resource, parameters('resourceAbbreviations').virtualNetworks)]",
                      "virtualNetworkDiagnosticSetting": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, parameters('resourceAbbreviations').virtualNetworks)]",
                      "workspaceFeed": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').workspaces), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceFeedDiagnosticSetting": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceFeedNetworkInterface": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceFeedPrivateEndpoint": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceGlobal": "[replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').workspaces), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceGlobalDiagnosticSetting": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').diagnosticSettings), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceGlobalNetworkInterface": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').networkInterfaces), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]",
                      "workspaceGlobalPrivateEndpoint": "[replace(replace(replace(variables('namingConvention_Service'), parameters('tokens').resource, parameters('resourceAbbreviations').privateEndpoints), parameters('tokens').service, format('{0}-{1}', parameters('tokens').service, parameters('resourceAbbreviations').workspaces)), format('-{0}', parameters('stampIndex')), '')]"
                    }
                  },
                  "resources": [],
                  "outputs": {
                    "names": {
                      "type": "object",
                      "value": "[variables('names')]"
                    }
                  }
                }
              }
            }
          ],
          "outputs": {
            "locationProperties": {
              "type": "object",
              "value": "[variables('locations')[parameters('location')]]"
            },
            "mlzTags": {
              "type": "object",
              "value": "[variables('mlzTags')]"
            },
            "privateDnsZones": {
              "type": "array",
              "value": "[variables('privateDnsZoneNames')]"
            },
            "tiers": {
              "type": "array",
              "copy": {
                "count": "[length(parameters('networks'))]",
                "input": {
                  "name": "[parameters('networks')[copyIndex()].name]",
                  "shortName": "[parameters('networks')[copyIndex()].shortName]",
                  "deployUniqueResources": "[parameters('networks')[copyIndex()].deployUniqueResources]",
                  "subscriptionId": "[parameters('networks')[copyIndex()].subscriptionId]",
                  "nsgDiagLogs": "[parameters('networks')[copyIndex()].nsgDiagLogs]",
                  "nsgDiagMetrics": "[parameters('networks')[copyIndex()].nsgDiagMetrics]",
                  "nsgRules": "[parameters('networks')[copyIndex()].nsgRules]",
                  "vnetAddressPrefix": "[parameters('networks')[copyIndex()].vnetAddressPrefix]",
                  "vnetDiagLogs": "[parameters('networks')[copyIndex()].vnetDiagLogs]",
                  "vnetDiagMetrics": "[parameters('networks')[copyIndex()].vnetDiagMetrics]",
                  "subnetAddressPrefix": "[parameters('networks')[copyIndex()].subnetAddressPrefix]",
                  "namingConvention": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('naming-convention-{0}-{1}', parameters('networks')[copyIndex()].shortName, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value]"
                }
              }
            },
            "tokens": {
              "type": "object",
              "value": "[variables('tokens')]"
            }
          }
        }
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "serviceToken": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tokens.value.service]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "299549075758739509"
            }
          },
          "parameters": {
            "deploymentNameSuffix": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "serviceToken": {
              "type": "string"
            },
            "tiers": {
              "type": "array"
            },
            "tags": {
              "type": "object"
            }
          },
          "resources": [
            {
              "copy": {
                "name": "resourceGroups",
                "count": "[length(parameters('tiers'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-rg-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[replace(parameters('tiers')[copyIndex()].namingConvention.resourceGroup, parameters('serviceToken'), 'network')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "16981911414796661053"
                    }
                  },
                  "parameters": {
                    "mlzTags": {
                      "type": "object"
                    },
                    "name": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object",
                      "defaultValue": {}
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/resourceGroups",
                      "apiVersion": "2019-05-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Resources/resourceGroups'), parameters('tags')['Microsoft.Resources/resourceGroups'], createObject()), parameters('mlzTags'))]"
                    }
                  ],
                  "outputs": {
                    "id": {
                      "type": "string",
                      "value": "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('name'))]"
                    },
                    "name": {
                      "type": "string",
                      "value": "[parameters('name')]"
                    },
                    "location": {
                      "type": "string",
                      "value": "[reference(subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('name')), '2019-05-01', 'full').location]"
                    },
                    "tags": {
                      "type": "object",
                      "value": "[reference(subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('name')), '2019-05-01', 'full').tags]"
                    }
                  }
                }
              }
            }
          ],
          "outputs": {
            "names": {
              "type": "array",
              "copy": {
                "count": "[length(parameters('tiers'))]",
                "input": "[reference(subscriptionResourceId(parameters('tiers')[copyIndex()].subscriptionId, 'Microsoft.Resources/deployments', format('deploy-rg-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.name.value]"
              }
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-networking-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "bastionHostSubnetAddressPrefix": {
            "value": "[parameters('bastionHostSubnetAddressPrefix')]"
          },
          "azureGatewaySubnetAddressPrefix": {
            "value": "[parameters('azureGatewaySubnetAddressPrefix')]"
          },
          "deployIdentity": {
            "value": "[parameters('deployIdentity')]"
          },
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "deployNetworkWatcher": {
            "value": "[parameters('deployNetworkWatcher')]"
          },
          "deployBastion": {
            "value": "[parameters('deployBastion')]"
          },
          "deployAzureGatewaySubnet": {
            "value": "[parameters('deployAzureGatewaySubnet')]"
          },
          "dnsServers": {
            "value": "[parameters('dnsServers')]"
          },
          "enableProxy": {
            "value": "[parameters('enableProxy')]"
          },
          "firewallSettings": {
            "value": {
              "clientPrivateIpAddress": "[variables('firewallClientPrivateIpAddress')]",
              "clientPublicIPAddressAvailabilityZones": "[parameters('firewallClientPublicIPAddressAvailabilityZones')]",
              "clientSubnetAddressPrefix": "[parameters('firewallClientSubnetAddressPrefix')]",
              "intrusionDetectionMode": "[parameters('firewallIntrusionDetectionMode')]",
              "managementPublicIPAddressAvailabilityZones": "[parameters('firewallManagementPublicIPAddressAvailabilityZones')]",
              "managementSubnetAddressPrefix": "[parameters('firewallManagementSubnetAddressPrefix')]",
              "skuTier": "[parameters('firewallSkuTier')]",
              "supernetIPAddress": "[parameters('firewallSupernetIPAddress')]",
              "threatIntelMode": "[parameters('firewallThreatIntelMode')]"
            }
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "privateDnsZoneNames": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZones.value]"
          },
          "resourceGroupNames": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "4240364673116660568"
            }
          },
          "parameters": {
            "bastionHostSubnetAddressPrefix": {
              "type": "string"
            },
            "azureGatewaySubnetAddressPrefix": {
              "type": "string"
            },
            "deployIdentity": {
              "type": "bool"
            },
            "deploymentNameSuffix": {
              "type": "string"
            },
            "deployNetworkWatcher": {
              "type": "bool"
            },
            "deployBastion": {
              "type": "bool"
            },
            "deployAzureGatewaySubnet": {
              "type": "bool"
            },
            "dnsServers": {
              "type": "array"
            },
            "enableProxy": {
              "type": "bool"
            },
            "firewallSettings": {
              "type": "object"
            },
            "location": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "privateDnsZoneNames": {
              "type": "array"
            },
            "resourceGroupNames": {
              "type": "array"
            },
            "tiers": {
              "type": "array"
            },
            "tags": {
              "type": "object"
            }
          },
          "variables": {
            "hub": "[filter(parameters('tiers'), lambda('tier', equals(lambdaVariables('tier').name, 'hub')))[0]]",
            "hubResourceGroupName": "[filter(parameters('resourceGroupNames'), lambda('name', contains(lambdaVariables('name'), 'hub')))[0]]",
            "spokes": "[filter(parameters('tiers'), lambda('tier', not(equals(lambdaVariables('tier').name, 'hub'))))]",
            "spokeResourceGroupNames": "[filter(parameters('resourceGroupNames'), lambda('name', not(contains(lambdaVariables('name'), 'hub'))))]"
          },
          "resources": [
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('hub').subscriptionId]",
              "resourceGroup": "[variables('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "bastionHostNetworkSecurityGroup": {
                    "value": "[variables('hub').namingConvention.bastionHostNetworkSecurityGroup]"
                  },
                  "bastionHostSubnetAddressPrefix": {
                    "value": "[parameters('bastionHostSubnetAddressPrefix')]"
                  },
                  "azureGatewaySubnetAddressPrefix": {
                    "value": "[parameters('azureGatewaySubnetAddressPrefix')]"
                  },
                  "deployNetworkWatcher": {
                    "value": "[parameters('deployNetworkWatcher')]"
                  },
                  "deployBastion": {
                    "value": "[parameters('deployBastion')]"
                  },
                  "deployAzureGatewaySubnet": {
                    "value": "[parameters('deployAzureGatewaySubnet')]"
                  },
                  "dnsServers": {
                    "value": "[parameters('dnsServers')]"
                  },
                  "enableProxy": {
                    "value": "[parameters('enableProxy')]"
                  },
                  "firewallClientPrivateIpAddress": {
                    "value": "[parameters('firewallSettings').clientPrivateIpAddress]"
                  },
                  "firewallClientPublicIPAddressAvailabilityZones": {
                    "value": "[parameters('firewallSettings').clientPublicIPAddressAvailabilityZones]"
                  },
                  "firewallClientPublicIPAddressName": {
                    "value": "[variables('hub').namingConvention.azureFirewallClientPublicIPAddress]"
                  },
                  "firewallClientSubnetAddressPrefix": {
                    "value": "[parameters('firewallSettings').clientSubnetAddressPrefix]"
                  },
                  "firewallIntrusionDetectionMode": {
                    "value": "[parameters('firewallSettings').intrusionDetectionMode]"
                  },
                  "firewallManagementPublicIPAddressAvailabilityZones": {
                    "value": "[parameters('firewallSettings').managementPublicIPAddressAvailabilityZones]"
                  },
                  "firewallManagementPublicIPAddressName": {
                    "value": "[variables('hub').namingConvention.azureFirewallManagementPublicIPAddress]"
                  },
                  "firewallManagementSubnetAddressPrefix": {
                    "value": "[parameters('firewallSettings').managementSubnetAddressPrefix]"
                  },
                  "firewallName": {
                    "value": "[variables('hub').namingConvention.azureFirewall]"
                  },
                  "firewallPolicyName": {
                    "value": "[variables('hub').namingConvention.azureFirewallPolicy]"
                  },
                  "firewallSkuTier": {
                    "value": "[parameters('firewallSettings').skuTier]"
                  },
                  "firewallSupernetIPAddress": {
                    "value": "[parameters('firewallSettings').supernetIPAddress]"
                  },
                  "firewallThreatIntelMode": {
                    "value": "[parameters('firewallSettings').threatIntelMode]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "networkSecurityGroupName": {
                    "value": "[variables('hub').namingConvention.networkSecurityGroup]"
                  },
                  "networkSecurityGroupRules": {
                    "value": "[variables('hub').nsgRules]"
                  },
                  "networkWatcherName": {
                    "value": "[variables('hub').namingConvention.networkWatcher]"
                  },
                  "routeTableName": {
                    "value": "[variables('hub').namingConvention.routeTable]"
                  },
                  "subnetAddressPrefix": {
                    "value": "[variables('hub').subnetAddressPrefix]"
                  },
                  "subnetName": {
                    "value": "[variables('hub').namingConvention.subnet]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "virtualNetworkAddressPrefix": {
                    "value": "[variables('hub').vnetAddressPrefix]"
                  },
                  "virtualNetworkName": {
                    "value": "[variables('hub').namingConvention.virtualNetwork]"
                  },
                  "vNetDnsServers": "[if(or(equals(parameters('firewallSettings').skuTier, 'Premium'), equals(parameters('firewallSettings').skuTier, 'Standard')), createObject('value', createArray(parameters('firewallSettings').clientPrivateIpAddress)), createObject('value', createArray()))]"
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "11334430934503633029"
                    }
                  },
                  "parameters": {
                    "bastionHostNetworkSecurityGroup": {
                      "type": "string"
                    },
                    "bastionHostSubnetAddressPrefix": {
                      "type": "string"
                    },
                    "azureGatewaySubnetAddressPrefix": {
                      "type": "string"
                    },
                    "deployNetworkWatcher": {
                      "type": "bool"
                    },
                    "deployBastion": {
                      "type": "bool"
                    },
                    "deployAzureGatewaySubnet": {
                      "type": "bool"
                    },
                    "dnsServers": {
                      "type": "array"
                    },
                    "enableProxy": {
                      "type": "bool"
                    },
                    "firewallClientPrivateIpAddress": {
                      "type": "string"
                    },
                    "firewallClientPublicIPAddressAvailabilityZones": {
                      "type": "array"
                    },
                    "firewallClientPublicIPAddressName": {
                      "type": "string"
                    },
                    "firewallClientSubnetAddressPrefix": {
                      "type": "string"
                    },
                    "firewallIntrusionDetectionMode": {
                      "type": "string",
                      "allowedValues": [
                        "Alert",
                        "Deny",
                        "Off"
                      ]
                    },
                    "firewallManagementPublicIPAddressAvailabilityZones": {
                      "type": "array"
                    },
                    "firewallManagementPublicIPAddressName": {
                      "type": "string"
                    },
                    "firewallManagementSubnetAddressPrefix": {
                      "type": "string"
                    },
                    "firewallName": {
                      "type": "string"
                    },
                    "firewallPolicyName": {
                      "type": "string"
                    },
                    "firewallSkuTier": {
                      "type": "string"
                    },
                    "firewallSupernetIPAddress": {
                      "type": "string"
                    },
                    "firewallThreatIntelMode": {
                      "type": "string",
                      "allowedValues": [
                        "Alert",
                        "Deny",
                        "Off"
                      ]
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "networkSecurityGroupName": {
                      "type": "string"
                    },
                    "networkSecurityGroupRules": {
                      "type": "array"
                    },
                    "networkWatcherName": {
                      "type": "string"
                    },
                    "routeTableName": {
                      "type": "string"
                    },
                    "subnetAddressPrefix": {
                      "type": "string"
                    },
                    "subnetName": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "virtualNetworkAddressPrefix": {
                      "type": "string"
                    },
                    "virtualNetworkName": {
                      "type": "string"
                    },
                    "vNetDnsServers": {
                      "type": "array"
                    }
                  },
                  "variables": {
                    "bastionNetworkSecurityGroupRules": [
                      {
                        "name": "AllowHttpsInBound",
                        "properties": {
                          "protocol": "Tcp",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "Internet",
                          "destinationPortRange": "443",
                          "destinationAddressPrefix": "*",
                          "access": "Allow",
                          "priority": 120,
                          "direction": "Inbound"
                        }
                      },
                      {
                        "name": "AllowGatewayManagerInBound",
                        "properties": {
                          "protocol": "Tcp",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "GatewayManager",
                          "destinationPortRange": "443",
                          "destinationAddressPrefix": "*",
                          "access": "Allow",
                          "priority": 130,
                          "direction": "Inbound"
                        }
                      },
                      {
                        "name": "AllowLoadBalancerInBound",
                        "properties": {
                          "protocol": "Tcp",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "AzureLoadBalancer",
                          "destinationPortRange": "443",
                          "destinationAddressPrefix": "*",
                          "access": "Allow",
                          "priority": 140,
                          "direction": "Inbound"
                        }
                      },
                      {
                        "name": "AllowBastionHostCommunicationInBound",
                        "properties": {
                          "protocol": "*",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "VirtualNetwork",
                          "destinationPortRanges": [
                            "8080",
                            "5701"
                          ],
                          "destinationAddressPrefix": "VirtualNetwork",
                          "access": "Allow",
                          "priority": 150,
                          "direction": "Inbound"
                        }
                      },
                      {
                        "name": "AllowSshRdpOutBound",
                        "properties": {
                          "protocol": "Tcp",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "*",
                          "destinationPortRanges": [
                            "22",
                            "3389"
                          ],
                          "destinationAddressPrefix": "VirtualNetwork",
                          "access": "Allow",
                          "priority": 120,
                          "direction": "Outbound"
                        }
                      },
                      {
                        "name": "AllowAzureCloudCommunicationOutBound",
                        "properties": {
                          "protocol": "Tcp",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "*",
                          "destinationPortRange": "443",
                          "destinationAddressPrefix": "AzureCloud",
                          "access": "Allow",
                          "priority": 130,
                          "direction": "Outbound"
                        }
                      },
                      {
                        "name": "AllowBastionHostCommunicationOutBound",
                        "properties": {
                          "protocol": "*",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "VirtualNetwork",
                          "destinationPortRanges": [
                            "8080",
                            "5701"
                          ],
                          "destinationAddressPrefix": "VirtualNetwork",
                          "access": "Allow",
                          "priority": 140,
                          "direction": "Outbound"
                        }
                      },
                      {
                        "name": "AllowGetSessionInformationOutBound",
                        "properties": {
                          "protocol": "*",
                          "sourcePortRange": "*",
                          "sourceAddressPrefix": "*",
                          "destinationAddressPrefix": "Internet",
                          "destinationPortRanges": [
                            "80",
                            "443"
                          ],
                          "access": "Allow",
                          "priority": 150,
                          "direction": "Outbound"
                        }
                      }
                    ]
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "networkSecurityGroup",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkSecurityGroupName')]"
                          },
                          "securityRules": {
                            "value": "[parameters('networkSecurityGroupRules')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "17152995037494078504"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "securityRules": {
                              "type": "array"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkSecurityGroups",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkSecurityGroups'), parameters('tags')['Microsoft.Network/networkSecurityGroups'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "securityRules": "[parameters('securityRules')]"
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "condition": "[parameters('deployBastion')]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "bastionNSG",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('bastionHostNetworkSecurityGroup')]"
                          },
                          "securityRules": {
                            "value": "[variables('bastionNetworkSecurityGroupRules')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "17152995037494078504"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "securityRules": {
                              "type": "array"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkSecurityGroups",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkSecurityGroups'), parameters('tags')['Microsoft.Network/networkSecurityGroups'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "securityRules": "[parameters('securityRules')]"
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "routeTable",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "disableBgpRoutePropagation": {
                            "value": false
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('routeTableName')]"
                          },
                          "routeNextHopIpAddress": {
                            "value": "[parameters('firewallClientPrivateIpAddress')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "8470734590353387928"
                            }
                          },
                          "parameters": {
                            "disableBgpRoutePropagation": {
                              "type": "bool"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "routeAddressPrefix": {
                              "type": "string",
                              "defaultValue": "0.0.0.0/0"
                            },
                            "routeName": {
                              "type": "string",
                              "defaultValue": "default_route"
                            },
                            "routeNextHopIpAddress": {
                              "type": "string"
                            },
                            "routeNextHopType": {
                              "type": "string",
                              "defaultValue": "VirtualAppliance"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/routeTables",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/routeTables'), parameters('tags')['Microsoft.Network/routeTables'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "disableBgpRoutePropagation": "[parameters('disableBgpRoutePropagation')]",
                                "routes": [
                                  {
                                    "name": "[parameters('routeName')]",
                                    "properties": {
                                      "addressPrefix": "[parameters('routeAddressPrefix')]",
                                      "nextHopIpAddress": "[parameters('routeNextHopIpAddress')]",
                                      "nextHopType": "[parameters('routeNextHopType')]"
                                    }
                                  }
                                ]
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/routeTables', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "condition": "[parameters('deployNetworkWatcher')]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "networkWatcher",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkWatcherName')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "4604600344009608460"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkWatchers'), parameters('tags')['Microsoft.Network/networkWatchers'], createObject()), parameters('mlzTags'))]",
                              "properties": {}
                            }
                          ]
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "virtualNetwork",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "addressPrefix": {
                            "value": "[parameters('virtualNetworkAddressPrefix')]"
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('virtualNetworkName')]"
                          },
                          "subnets": {
                            "value": "[union(createArray(createObject('name', 'AzureFirewallSubnet', 'properties', createObject('addressPrefix', parameters('firewallClientSubnetAddressPrefix'))), createObject('name', 'AzureFirewallManagementSubnet', 'properties', createObject('addressPrefix', parameters('firewallManagementSubnetAddressPrefix'))), createObject('name', parameters('subnetName'), 'properties', createObject('addressPrefix', parameters('subnetAddressPrefix'), 'networkSecurityGroup', createObject('id', reference(resourceId('Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.id.value), 'privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Disabled', 'routeTable', createObject('id', reference(resourceId('Microsoft.Resources/deployments', 'routeTable'), '2022-09-01').outputs.id.value)))), if(parameters('deployBastion'), createArray(createObject('name', 'AzureBastionSubnet', 'properties', createObject('addressPrefix', parameters('bastionHostSubnetAddressPrefix'), 'networkSecurityGroup', createObject('id', reference(resourceId('Microsoft.Resources/deployments', 'bastionNSG'), '2022-09-01').outputs.id.value)))), createArray()), if(parameters('deployAzureGatewaySubnet'), createArray(createObject('name', 'GatewaySubnet', 'properties', createObject('addressPrefix', parameters('azureGatewaySubnetAddressPrefix')))), createArray()))]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          },
                          "vNetDnsServers": {
                            "value": "[parameters('vNetDnsServers')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "12920788887150549633"
                            }
                          },
                          "parameters": {
                            "addressPrefix": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "subnets": {
                              "type": "array"
                            },
                            "tags": {
                              "type": "object"
                            },
                            "vNetDnsServers": {
                              "type": "array"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/virtualNetworks",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/virtualNetworks'), parameters('tags')['Microsoft.Network/virtualNetworks'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "addressSpace": {
                                  "addressPrefixes": [
                                    "[parameters('addressPrefix')]"
                                  ]
                                },
                                "subnets": "[parameters('subnets')]",
                                "dhcpOptions": "[if(empty(parameters('vNetDnsServers')), null(), createObject('dnsServers', parameters('vNetDnsServers')))]"
                              }
                            }
                          ],
                          "outputs": {
                            "addressPrefix": {
                              "type": "string",
                              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), '2021-02-01').addressSpace.addressPrefixes[0]]"
                            },
                            "dnsServers": {
                              "type": "array",
                              "value": "[parameters('vNetDnsServers')]"
                            },
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            },
                            "subnets": {
                              "type": "array",
                              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), '2021-02-01').subnets]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Resources/deployments', 'bastionNSG')]",
                        "[resourceId('Microsoft.Resources/deployments', 'networkSecurityGroup')]",
                        "[resourceId('Microsoft.Resources/deployments', 'networkWatcher')]",
                        "[resourceId('Microsoft.Resources/deployments', 'routeTable')]"
                      ]
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "firewallClientPublicIPAddress",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "availabilityZones": {
                            "value": "[parameters('firewallClientPublicIPAddressAvailabilityZones')]"
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('firewallClientPublicIPAddressName')]"
                          },
                          "publicIpAllocationMethod": {
                            "value": "Static"
                          },
                          "skuName": {
                            "value": "Standard"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "8113247435674435676"
                            }
                          },
                          "parameters": {
                            "availabilityZones": {
                              "type": "array"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "publicIpAllocationMethod": {
                              "type": "string"
                            },
                            "skuName": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/publicIPAddresses",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/publicIPAddresses'), parameters('tags')['Microsoft.Network/publicIPAddresses'], createObject()), parameters('mlzTags'))]",
                              "sku": {
                                "name": "[parameters('skuName')]"
                              },
                              "properties": {
                                "publicIPAllocationMethod": "[parameters('publicIpAllocationMethod')]"
                              },
                              "zones": "[parameters('availabilityZones')]"
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "firewallManagementPublicIPAddress",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "availabilityZones": {
                            "value": "[parameters('firewallManagementPublicIPAddressAvailabilityZones')]"
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('firewallManagementPublicIPAddressName')]"
                          },
                          "publicIpAllocationMethod": {
                            "value": "Static"
                          },
                          "skuName": {
                            "value": "Standard"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "8113247435674435676"
                            }
                          },
                          "parameters": {
                            "availabilityZones": {
                              "type": "array"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "publicIpAllocationMethod": {
                              "type": "string"
                            },
                            "skuName": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/publicIPAddresses",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/publicIPAddresses'), parameters('tags')['Microsoft.Network/publicIPAddresses'], createObject()), parameters('mlzTags'))]",
                              "sku": {
                                "name": "[parameters('skuName')]"
                              },
                              "properties": {
                                "publicIPAllocationMethod": "[parameters('publicIpAllocationMethod')]"
                              },
                              "zones": "[parameters('availabilityZones')]"
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('name'))]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "firewall",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "clientIpConfigurationPublicIPAddressResourceId": {
                            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'firewallClientPublicIPAddress'), '2022-09-01').outputs.id.value]"
                          },
                          "clientIpConfigurationSubnetResourceId": {
                            "value": "[format('{0}/subnets/AzureFirewallSubnet', reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.id.value)]"
                          },
                          "dnsServers": {
                            "value": "[parameters('dnsServers')]"
                          },
                          "enableProxy": {
                            "value": "[parameters('enableProxy')]"
                          },
                          "firewallPolicyName": {
                            "value": "[parameters('firewallPolicyName')]"
                          },
                          "firewallSupernetIPAddress": {
                            "value": "[parameters('firewallSupernetIPAddress')]"
                          },
                          "intrusionDetectionMode": {
                            "value": "[parameters('firewallIntrusionDetectionMode')]"
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "managementIpConfigurationPublicIPAddressResourceId": {
                            "value": "[reference(resourceId('Microsoft.Resources/deployments', 'firewallManagementPublicIPAddress'), '2022-09-01').outputs.id.value]"
                          },
                          "managementIpConfigurationSubnetResourceId": {
                            "value": "[format('{0}/subnets/AzureFirewallManagementSubnet', reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.id.value)]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('firewallName')]"
                          },
                          "skuTier": {
                            "value": "[parameters('firewallSkuTier')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          },
                          "threatIntelMode": {
                            "value": "[parameters('firewallThreatIntelMode')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "14336779168214254237"
                            }
                          },
                          "parameters": {
                            "clientIpConfigurationSubnetResourceId": {
                              "type": "string"
                            },
                            "clientIpConfigurationPublicIPAddressResourceId": {
                              "type": "string"
                            },
                            "dnsServers": {
                              "type": "array"
                            },
                            "enableProxy": {
                              "type": "bool"
                            },
                            "firewallPolicyName": {
                              "type": "string"
                            },
                            "firewallSupernetIPAddress": {
                              "type": "string"
                            },
                            "intrusionDetectionMode": {
                              "type": "string",
                              "allowedValues": [
                                "Alert",
                                "Deny",
                                "Off"
                              ]
                            },
                            "location": {
                              "type": "string"
                            },
                            "managementIpConfigurationSubnetResourceId": {
                              "type": "string"
                            },
                            "managementIpConfigurationPublicIPAddressResourceId": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "skuTier": {
                              "type": "string",
                              "allowedValues": [
                                "Standard",
                                "Premium",
                                "Basic"
                              ]
                            },
                            "tags": {
                              "type": "object",
                              "defaultValue": {}
                            },
                            "threatIntelMode": {
                              "type": "string",
                              "allowedValues": [
                                "Alert",
                                "Deny",
                                "Off"
                              ]
                            }
                          },
                          "variables": {
                            "intrusionDetectionObject": {
                              "mode": "[parameters('intrusionDetectionMode')]"
                            },
                            "dnsSettings": {
                              "enableProxy": "[parameters('enableProxy')]",
                              "servers": "[parameters('dnsServers')]"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/firewallPolicies",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('firewallPolicyName')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/firewallPolicies'), parameters('tags')['Microsoft.Network/firewallPolicies'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "threatIntelMode": "[parameters('threatIntelMode')]",
                                "intrusionDetection": "[if(equals(parameters('skuTier'), 'Premium'), variables('intrusionDetectionObject'), null())]",
                                "sku": {
                                  "tier": "[parameters('skuTier')]"
                                },
                                "dnsSettings": "[if(or(equals(parameters('skuTier'), 'Premium'), equals(parameters('skuTier'), 'Standard')), variables('dnsSettings'), null())]"
                              }
                            },
                            {
                              "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
                              "apiVersion": "2021-02-01",
                              "name": "[format('{0}/{1}', parameters('firewallPolicyName'), 'DefaultApplicationRuleCollectionGroup')]",
                              "properties": {
                                "priority": 300,
                                "ruleCollections": [
                                  {
                                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                                    "action": {
                                      "type": "Allow"
                                    },
                                    "rules": [
                                      {
                                        "ruleType": "ApplicationRule",
                                        "name": "msftauth",
                                        "protocols": [
                                          {
                                            "protocolType": "Https",
                                            "port": 443
                                          }
                                        ],
                                        "fqdnTags": [],
                                        "webCategories": [],
                                        "targetFqdns": [
                                          "aadcdn.msftauth.net",
                                          "aadcdn.msauth.net"
                                        ],
                                        "targetUrls": [],
                                        "terminateTLS": false,
                                        "sourceAddresses": [
                                          "*"
                                        ],
                                        "destinationAddresses": [],
                                        "sourceIpGroups": []
                                      }
                                    ],
                                    "name": "AzureAuth",
                                    "priority": 110
                                  }
                                ]
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
                              ]
                            },
                            {
                              "type": "Microsoft.Network/firewallPolicies/ruleCollectionGroups",
                              "apiVersion": "2021-02-01",
                              "name": "[format('{0}/{1}', parameters('firewallPolicyName'), 'DefaultNetworkRuleCollectionGroup')]",
                              "properties": {
                                "priority": 200,
                                "ruleCollections": [
                                  {
                                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                                    "action": {
                                      "type": "Allow"
                                    },
                                    "rules": [
                                      {
                                        "ruleType": "NetworkRule",
                                        "name": "AzureCloud",
                                        "ipProtocols": [
                                          "Any"
                                        ],
                                        "sourceAddresses": [
                                          "*"
                                        ],
                                        "sourceIpGroups": [],
                                        "destinationAddresses": [
                                          "AzureCloud"
                                        ],
                                        "destinationIpGroups": [],
                                        "destinationFqdns": [],
                                        "destinationPorts": [
                                          "*"
                                        ]
                                      }
                                    ],
                                    "name": "AllowAzureCloud",
                                    "priority": 100
                                  },
                                  {
                                    "ruleCollectionType": "FirewallPolicyFilterRuleCollection",
                                    "action": {
                                      "type": "Allow"
                                    },
                                    "rules": [
                                      {
                                        "ruleType": "NetworkRule",
                                        "name": "AllSpokeTraffic",
                                        "ipProtocols": [
                                          "Any"
                                        ],
                                        "sourceAddresses": [
                                          "[parameters('firewallSupernetIPAddress')]"
                                        ],
                                        "sourceIpGroups": [],
                                        "destinationAddresses": [
                                          "*"
                                        ],
                                        "destinationIpGroups": [],
                                        "destinationFqdns": [],
                                        "destinationPorts": [
                                          "*"
                                        ]
                                      }
                                    ],
                                    "name": "AllowTrafficBetweenSpokes",
                                    "priority": 200
                                  }
                                ]
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultApplicationRuleCollectionGroup')]",
                                "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
                              ]
                            },
                            {
                              "type": "Microsoft.Network/azureFirewalls",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/azureFirewalls'), parameters('tags')['Microsoft.Network/azureFirewalls'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "ipConfigurations": [
                                  {
                                    "name": "ipconfig-client",
                                    "properties": {
                                      "subnet": {
                                        "id": "[parameters('clientIpConfigurationSubnetResourceId')]"
                                      },
                                      "publicIPAddress": {
                                        "id": "[parameters('clientIpConfigurationPublicIPAddressResourceId')]"
                                      }
                                    }
                                  }
                                ],
                                "managementIpConfiguration": {
                                  "name": "ipconfig-management",
                                  "properties": {
                                    "subnet": {
                                      "id": "[parameters('managementIpConfigurationSubnetResourceId')]"
                                    },
                                    "publicIPAddress": {
                                      "id": "[parameters('managementIpConfigurationPublicIPAddressResourceId')]"
                                    }
                                  }
                                },
                                "firewallPolicy": {
                                  "id": "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
                                },
                                "sku": {
                                  "tier": "[parameters('skuTier')]"
                                }
                              },
                              "dependsOn": [
                                "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultApplicationRuleCollectionGroup')]",
                                "[resourceId('Microsoft.Network/firewallPolicies/ruleCollectionGroups', parameters('firewallPolicyName'), 'DefaultNetworkRuleCollectionGroup')]",
                                "[resourceId('Microsoft.Network/firewallPolicies', parameters('firewallPolicyName'))]"
                              ]
                            }
                          ],
                          "outputs": {
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            },
                            "privateIPAddress": {
                              "type": "string",
                              "value": "[reference(resourceId('Microsoft.Network/azureFirewalls', parameters('name')), '2021-02-01').ipConfigurations[0].properties.privateIPAddress]"
                            },
                            "resourceId": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/azureFirewalls', parameters('name'))]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Resources/deployments', 'firewallClientPublicIPAddress')]",
                        "[resourceId('Microsoft.Resources/deployments', 'firewallManagementPublicIPAddress')]",
                        "[resourceId('Microsoft.Resources/deployments', 'virtualNetwork')]"
                      ]
                    }
                  ],
                  "outputs": {
                    "bastionHostSubnetResourceId": {
                      "type": "string",
                      "value": "[if(parameters('deployBastion'), reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[3].id, '')]"
                    },
                    "dnsServers": {
                      "type": "array",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.dnsServers.value]"
                    },
                    "firewallName": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'firewall'), '2022-09-01').outputs.name.value]"
                    },
                    "firewallPrivateIPAddress": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'firewall'), '2022-09-01').outputs.privateIPAddress.value]"
                    },
                    "firewallResourceId": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'firewall'), '2022-09-01').outputs.resourceId.value]"
                    },
                    "networkSecurityGroupName": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.name.value]"
                    },
                    "networkSecurityGroupResourceId": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.id.value]"
                    },
                    "subnetAddressPrefix": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[2].properties.addressPrefix]"
                    },
                    "subnetName": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[2].name]"
                    },
                    "subnetResourceId": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[2].id]"
                    },
                    "virtualNetworkName": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.name.value]"
                    },
                    "virtualNetworkResourceId": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.id.value]"
                    }
                  }
                }
              }
            },
            {
              "copy": {
                "name": "spokeNetworks",
                "count": "[length(variables('spokes'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-vnet-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deployNetworkWatcher": {
                    "value": "[and(parameters('deployNetworkWatcher'), variables('spokes')[copyIndex()].deployUniqueResources)]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "networkSecurityGroupName": {
                    "value": "[variables('spokes')[copyIndex()].namingConvention.networkSecurityGroup]"
                  },
                  "networkSecurityGroupRules": {
                    "value": "[variables('spokes')[copyIndex()].nsgRules]"
                  },
                  "networkWatcherName": {
                    "value": "[variables('spokes')[copyIndex()].namingConvention.networkWatcher]"
                  },
                  "resourceGroupName": {
                    "value": "[variables('spokeResourceGroupNames')[copyIndex()]]"
                  },
                  "routeTableName": {
                    "value": "[variables('spokes')[copyIndex()].namingConvention.routeTable]"
                  },
                  "routeTableRouteNextHopIpAddress": {
                    "value": "[parameters('firewallSettings').clientPrivateIpAddress]"
                  },
                  "subnetAddressPrefix": {
                    "value": "[variables('spokes')[copyIndex()].subnetAddressPrefix]"
                  },
                  "subnetName": {
                    "value": "[variables('spokes')[copyIndex()].namingConvention.subnet]"
                  },
                  "subscriptionId": {
                    "value": "[variables('spokes')[copyIndex()].subscriptionId]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "virtualNetworkAddressPrefix": {
                    "value": "[variables('spokes')[copyIndex()].vnetAddressPrefix]"
                  },
                  "virtualNetworkName": {
                    "value": "[variables('spokes')[copyIndex()].namingConvention.virtualNetwork]"
                  },
                  "vNetDnsServers": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.dnsServers.value]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "15250750281746986897"
                    }
                  },
                  "parameters": {
                    "additionalSubnets": {
                      "type": "array",
                      "defaultValue": []
                    },
                    "deployNetworkWatcher": {
                      "type": "bool"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "networkSecurityGroupName": {
                      "type": "string"
                    },
                    "networkSecurityGroupRules": {
                      "type": "array"
                    },
                    "networkWatcherName": {
                      "type": "string"
                    },
                    "resourceGroupName": {
                      "type": "string"
                    },
                    "routeTableName": {
                      "type": "string"
                    },
                    "routeTableRouteNextHopIpAddress": {
                      "type": "string"
                    },
                    "subnetAddressPrefix": {
                      "type": "string"
                    },
                    "subnetName": {
                      "type": "string"
                    },
                    "subscriptionId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "virtualNetworkAddressPrefix": {
                      "type": "string"
                    },
                    "virtualNetworkName": {
                      "type": "string"
                    },
                    "vNetDnsServers": {
                      "type": "array"
                    }
                  },
                  "variables": {
                    "delegations": {
                      "AzureNetAppFiles": [
                        {
                          "name": "Microsoft.Netapp.volumes",
                          "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets/delegations', parameters('virtualNetworkName'), 'AzureNetAppFiles', 'Microsoft.Netapp.volumes')]",
                          "properties": {
                            "serviceName": "Microsoft.Netapp/volumes"
                          },
                          "type": "Microsoft.Network/virtualNetworks/subnets/delegations"
                        }
                      ]
                    },
                    "subnets": "[union(createArray(createObject('name', parameters('subnetName'), 'properties', createObject('addressPrefix', parameters('subnetAddressPrefix')))), parameters('additionalSubnets'))]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "networkSecurityGroup",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkSecurityGroupName')]"
                          },
                          "securityRules": {
                            "value": "[parameters('networkSecurityGroupRules')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "17152995037494078504"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "securityRules": {
                              "type": "array"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkSecurityGroups",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkSecurityGroups'), parameters('tags')['Microsoft.Network/networkSecurityGroups'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "securityRules": "[parameters('securityRules')]"
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/networkSecurityGroups', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "routeTable",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "disableBgpRoutePropagation": {
                            "value": true
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('routeTableName')]"
                          },
                          "routeNextHopIpAddress": {
                            "value": "[parameters('routeTableRouteNextHopIpAddress')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "8470734590353387928"
                            }
                          },
                          "parameters": {
                            "disableBgpRoutePropagation": {
                              "type": "bool"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "routeAddressPrefix": {
                              "type": "string",
                              "defaultValue": "0.0.0.0/0"
                            },
                            "routeName": {
                              "type": "string",
                              "defaultValue": "default_route"
                            },
                            "routeNextHopIpAddress": {
                              "type": "string"
                            },
                            "routeNextHopType": {
                              "type": "string",
                              "defaultValue": "VirtualAppliance"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/routeTables",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/routeTables'), parameters('tags')['Microsoft.Network/routeTables'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "disableBgpRoutePropagation": "[parameters('disableBgpRoutePropagation')]",
                                "routes": [
                                  {
                                    "name": "[parameters('routeName')]",
                                    "properties": {
                                      "addressPrefix": "[parameters('routeAddressPrefix')]",
                                      "nextHopIpAddress": "[parameters('routeNextHopIpAddress')]",
                                      "nextHopType": "[parameters('routeNextHopType')]"
                                    }
                                  }
                                ]
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/routeTables', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    },
                    {
                      "condition": "[parameters('deployNetworkWatcher')]",
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "networkWatcher",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkWatcherName')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "4604600344009608460"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkWatchers",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkWatchers'), parameters('tags')['Microsoft.Network/networkWatchers'], createObject()), parameters('mlzTags'))]",
                              "properties": {}
                            }
                          ]
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "virtualNetwork",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "addressPrefix": {
                            "value": "[parameters('virtualNetworkAddressPrefix')]"
                          },
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('virtualNetworkName')]"
                          },
                          "subnets": {
                            "copy": [
                              {
                                "name": "value",
                                "count": "[length(variables('subnets'))]",
                                "input": "[createObject('name', variables('subnets')[copyIndex('value')].name, 'properties', createObject('addressPrefix', variables('subnets')[copyIndex('value')].properties.addressPrefix, 'delegations', coalesce(tryGet(variables('delegations'), variables('subnets')[copyIndex('value')].name), createArray()), 'networkSecurityGroup', createObject('id', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.id.value), 'routeTable', createObject('id', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'routeTable'), '2022-09-01').outputs.id.value), 'privateEndpointNetworkPolicies', 'Disabled', 'privateLinkServiceNetworkPolicies', 'Disabled'))]"
                              }
                            ]
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          },
                          "vNetDnsServers": {
                            "value": "[parameters('vNetDnsServers')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "12920788887150549633"
                            }
                          },
                          "parameters": {
                            "addressPrefix": {
                              "type": "string"
                            },
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object"
                            },
                            "name": {
                              "type": "string"
                            },
                            "subnets": {
                              "type": "array"
                            },
                            "tags": {
                              "type": "object"
                            },
                            "vNetDnsServers": {
                              "type": "array"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/virtualNetworks",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/virtualNetworks'), parameters('tags')['Microsoft.Network/virtualNetworks'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "addressSpace": {
                                  "addressPrefixes": [
                                    "[parameters('addressPrefix')]"
                                  ]
                                },
                                "subnets": "[parameters('subnets')]",
                                "dhcpOptions": "[if(empty(parameters('vNetDnsServers')), null(), createObject('dnsServers', parameters('vNetDnsServers')))]"
                              }
                            }
                          ],
                          "outputs": {
                            "addressPrefix": {
                              "type": "string",
                              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), '2021-02-01').addressSpace.addressPrefixes[0]]"
                            },
                            "dnsServers": {
                              "type": "array",
                              "value": "[parameters('vNetDnsServers')]"
                            },
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/virtualNetworks', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            },
                            "subnets": {
                              "type": "array",
                              "value": "[reference(resourceId('Microsoft.Network/virtualNetworks', parameters('name')), '2021-02-01').subnets]"
                            }
                          }
                        }
                      },
                      "dependsOn": [
                        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'networkSecurityGroup')]",
                        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'networkWatcher')]",
                        "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'routeTable')]"
                      ]
                    }
                  ],
                  "outputs": {
                    "virtualNetworkName": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.name.value]"
                    },
                    "virtualNetworkResourceId": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.id.value]"
                    },
                    "virtualNetworkAddressPrefix": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.addressPrefix.value]"
                    },
                    "subnetName": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[0].name]"
                    },
                    "subnetAddressPrefix": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[0].properties.addressPrefix]"
                    },
                    "subnetResourceId": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'virtualNetwork'), '2022-09-01').outputs.subnets.value[0].id]"
                    },
                    "networkSecurityGroupName": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.name.value]"
                    },
                    "networkSecurityGroupResourceId": {
                      "type": "string",
                      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('subscriptionId'), parameters('resourceGroupName')), 'Microsoft.Resources/deployments', 'networkSecurityGroup'), '2022-09-01').outputs.id.value]"
                    }
                  }
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix')))]"
              ]
            },
            {
              "copy": {
                "name": "hubVirtualNetworkPeerings",
                "count": "[length(variables('spokes'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-vnet-peerings-hub-{0}-{1}', copyIndex(), parameters('deploymentNameSuffix'))]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deploymentNameSuffix": {
                    "value": "[parameters('deploymentNameSuffix')]"
                  },
                  "hubVirtualNetworkName": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkName.value]"
                  },
                  "resourceGroupName": {
                    "value": "[variables('hubResourceGroupName')]"
                  },
                  "spokeShortName": {
                    "value": "[variables('spokes')[copyIndex()].shortName]"
                  },
                  "spokeVirtualNetworkResourceId": {
                    "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkResourceId.value]"
                  },
                  "subscriptionId": {
                    "value": "[variables('hub').subscriptionId]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "1031623525996139958"
                    }
                  },
                  "parameters": {
                    "deploymentNameSuffix": {
                      "type": "string"
                    },
                    "hubVirtualNetworkName": {
                      "type": "string"
                    },
                    "resourceGroupName": {
                      "type": "string"
                    },
                    "spokeShortName": {
                      "type": "string"
                    },
                    "spokeVirtualNetworkResourceId": {
                      "type": "string"
                    },
                    "subscriptionId": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('peer-hub-to-{0}-{1}', parameters('spokeShortName'), parameters('deploymentNameSuffix'))]",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "remoteVirtualNetworkResourceId": {
                            "value": "[parameters('spokeVirtualNetworkResourceId')]"
                          },
                          "virtualNetworkName": {
                            "value": "[parameters('hubVirtualNetworkName')]"
                          },
                          "virtualNetworkPeerName": {
                            "value": "[format('to-{0}', split(parameters('spokeVirtualNetworkResourceId'), '/')[8])]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "17390826727171662541"
                            }
                          },
                          "parameters": {
                            "remoteVirtualNetworkResourceId": {
                              "type": "string"
                            },
                            "virtualNetworkName": {
                              "type": "string"
                            },
                            "virtualNetworkPeerName": {
                              "type": "string"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
                              "apiVersion": "2021-02-01",
                              "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('virtualNetworkPeerName'))]",
                              "properties": {
                                "allowForwardedTraffic": true,
                                "remoteVirtualNetwork": {
                                  "id": "[parameters('remoteVirtualNetworkResourceId')]"
                                }
                              }
                            }
                          ]
                        }
                      }
                    }
                  ]
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix')))]",
                "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix')))]"
              ]
            },
            {
              "copy": {
                "name": "spokeVirtualNetworkPeerings",
                "count": "[length(variables('spokes'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-vnet-peerings-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deploymentNameSuffix": {
                    "value": "[parameters('deploymentNameSuffix')]"
                  },
                  "hubVirtualNetworkResourceId": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkResourceId.value]"
                  },
                  "resourceGroupName": {
                    "value": "[variables('spokeResourceGroupNames')[copyIndex()]]"
                  },
                  "spokeShortName": {
                    "value": "[variables('spokes')[copyIndex()].shortName]"
                  },
                  "spokeVirtualNetworkName": {
                    "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkName.value]"
                  },
                  "subscriptionId": {
                    "value": "[variables('spokes')[copyIndex()].subscriptionId]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "3137630721293344936"
                    }
                  },
                  "parameters": {
                    "deploymentNameSuffix": {
                      "type": "string"
                    },
                    "hubVirtualNetworkResourceId": {
                      "type": "string"
                    },
                    "resourceGroupName": {
                      "type": "string"
                    },
                    "spokeShortName": {
                      "type": "string"
                    },
                    "spokeVirtualNetworkName": {
                      "type": "string"
                    },
                    "subscriptionId": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('peer-{0}-to-hub-{1}', parameters('spokeShortName'), parameters('deploymentNameSuffix'))]",
                      "subscriptionId": "[parameters('subscriptionId')]",
                      "resourceGroup": "[parameters('resourceGroupName')]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "remoteVirtualNetworkResourceId": {
                            "value": "[parameters('hubVirtualNetworkResourceId')]"
                          },
                          "virtualNetworkName": {
                            "value": "[parameters('spokeVirtualNetworkName')]"
                          },
                          "virtualNetworkPeerName": {
                            "value": "[format('to-{0}', split(parameters('hubVirtualNetworkResourceId'), '/')[8])]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "17390826727171662541"
                            }
                          },
                          "parameters": {
                            "remoteVirtualNetworkResourceId": {
                              "type": "string"
                            },
                            "virtualNetworkName": {
                              "type": "string"
                            },
                            "virtualNetworkPeerName": {
                              "type": "string"
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
                              "apiVersion": "2021-02-01",
                              "name": "[format('{0}/{1}', parameters('virtualNetworkName'), parameters('virtualNetworkPeerName'))]",
                              "properties": {
                                "allowForwardedTraffic": true,
                                "remoteVirtualNetwork": {
                                  "id": "[parameters('remoteVirtualNetworkResourceId')]"
                                }
                              }
                            }
                          ]
                        }
                      }
                    }
                  ]
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix')))]",
                "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[copyIndex()].name, parameters('deploymentNameSuffix')))]"
              ]
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-private-dns-zones-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('hub').subscriptionId]",
              "resourceGroup": "[variables('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deployIdentity": {
                    "value": "[parameters('deployIdentity')]"
                  },
                  "deploymentNameSuffix": {
                    "value": "[parameters('deploymentNameSuffix')]"
                  },
                  "hubVirtualNetworkResourceId": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkResourceId.value]"
                  },
                  "identityVirtualNetworkResourceId": "[if(parameters('deployIdentity'), createObject('value', reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[2].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkResourceId.value), createObject('value', ''))]",
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "privateDnsZoneNames": {
                    "value": "[parameters('privateDnsZoneNames')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "1828997274967234816"
                    }
                  },
                  "parameters": {
                    "deployIdentity": {
                      "type": "bool"
                    },
                    "deploymentNameSuffix": {
                      "type": "string"
                    },
                    "hubVirtualNetworkResourceId": {
                      "type": "string"
                    },
                    "identityVirtualNetworkResourceId": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "privateDnsZoneNames": {
                      "type": "array"
                    },
                    "tags": {
                      "type": "object"
                    }
                  },
                  "variables": {
                    "virtualNetworks": "[union(createArray(createObject('name', split(parameters('hubVirtualNetworkResourceId'), '/')[8], 'resourceGroupName', split(parameters('hubVirtualNetworkResourceId'), '/')[4], 'subscriptionId', split(parameters('hubVirtualNetworkResourceId'), '/')[2])), if(parameters('deployIdentity'), createArray(createObject('name', split(parameters('identityVirtualNetworkResourceId'), '/')[8], 'resourceGroupName', split(parameters('identityVirtualNetworkResourceId'), '/')[4], 'subscriptionId', split(parameters('identityVirtualNetworkResourceId'), '/')[2])), createArray()))]"
                  },
                  "resources": [
                    {
                      "copy": {
                        "name": "privateDnsZones",
                        "count": "[length(parameters('privateDnsZoneNames'))]"
                      },
                      "type": "Microsoft.Network/privateDnsZones",
                      "apiVersion": "2018-09-01",
                      "name": "[parameters('privateDnsZoneNames')[copyIndex()]]",
                      "location": "global",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/privateDnsZones'), parameters('tags')['Microsoft.Network/privateDnsZones'], createObject()), parameters('mlzTags'))]"
                    },
                    {
                      "copy": {
                        "name": "virtualNetworkLinks",
                        "count": "[length(variables('virtualNetworks'))]",
                        "mode": "serial",
                        "batchSize": 1
                      },
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('deploy-virtual-network-links-{0}-{1}', copyIndex(), parameters('deploymentNameSuffix'))]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "privateDnsZoneNames": {
                            "value": "[parameters('privateDnsZoneNames')]"
                          },
                          "virtualNetworkName": {
                            "value": "[variables('virtualNetworks')[copyIndex()].name]"
                          },
                          "virtualNetworkResourceGroupName": {
                            "value": "[variables('virtualNetworks')[copyIndex()].resourceGroupName]"
                          },
                          "virtualNetworkSubscriptionId": {
                            "value": "[variables('virtualNetworks')[copyIndex()].subscriptionId]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "13752723825727791999"
                            }
                          },
                          "parameters": {
                            "privateDnsZoneNames": {
                              "type": "array"
                            },
                            "virtualNetworkName": {
                              "type": "string"
                            },
                            "virtualNetworkResourceGroupName": {
                              "type": "string"
                            },
                            "virtualNetworkSubscriptionId": {
                              "type": "string"
                            }
                          },
                          "resources": [
                            {
                              "copy": {
                                "name": "virtualNetworkLinks",
                                "count": "[length(parameters('privateDnsZoneNames'))]"
                              },
                              "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
                              "apiVersion": "2018-09-01",
                              "name": "[format('{0}/{1}', parameters('privateDnsZoneNames')[copyIndex()], parameters('virtualNetworkName'))]",
                              "location": "global",
                              "properties": {
                                "registrationEnabled": false,
                                "virtualNetwork": {
                                  "id": "[resourceId(parameters('virtualNetworkSubscriptionId'), parameters('virtualNetworkResourceGroupName'), 'Microsoft.Network/virtualNetworks', parameters('virtualNetworkName'))]"
                                }
                              }
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "privateDnsZones"
                      ]
                    }
                  ],
                  "outputs": {
                    "privateDnsZoneResourceIds": {
                      "type": "object",
                      "value": {
                        "agentSvc": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', startsWith(lambdaVariables('name'), 'privatelink.agentsvc')))[0])]",
                        "blob": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'blob')))[0])]",
                        "file": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'file')))[0])]",
                        "keyVault": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'vaultcore')))[0])]",
                        "monitor": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'monitor')))[0])]",
                        "ods": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'ods.opinsights')))[0])]",
                        "oms": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'oms.opinsights')))[0])]",
                        "queue": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'queue')))[0])]",
                        "table": "[resourceId('Microsoft.Network/privateDnsZones', filter(parameters('privateDnsZoneNames'), lambda('name', contains(lambdaVariables('name'), 'table')))[0])]"
                      }
                    }
                  }
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix')))]",
                "spokeNetworks"
              ]
            }
          ],
          "outputs": {
            "azureFirewallResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.firewallResourceId.value]"
            },
            "bastionHostSubnetResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.bastionHostSubnetResourceId.value]"
            },
            "sharedServicesSubnetResourceId": {
              "type": "string",
              "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[1].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.subnetResourceId.value]"
            },
            "hubNetworkSecurityGroupResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.networkSecurityGroupResourceId.value]"
            },
            "hubSubnetResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.subnetResourceId.value]"
            },
            "hubVirtualNetworkResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-vnet-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.virtualNetworkResourceId.value]"
            },
            "identitySubnetResourceId": {
              "type": "string",
              "value": "[if(parameters('deployIdentity'), reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[2].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.subnetResourceId.value, '')]"
            },
            "operationsSubnetResourceId": {
              "type": "string",
              "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-vnet-{0}-{1}', variables('spokes')[0].name, parameters('deploymentNameSuffix'))), '2022-09-01').outputs.subnetResourceId.value]"
            },
            "privateDnsZoneResourceIds": {
              "type": "object",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', variables('hub').subscriptionId, variables('hubResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-private-dns-zones-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZoneResourceIds.value]"
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "tier": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value, lambda('tier', equals(lambdaVariables('tier').name, 'hub')))[0]]"
          },
          "resourceGroupName": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value, lambda('name', contains(lambdaVariables('name'), 'hub')))[0]]"
          },
          "keyVaultPrivateDnsZoneResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZoneResourceIds.value.keyVault]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "subnetResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.hubSubnetResourceId.value]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          },
          "tokens": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tokens.value]"
          },
          "workloadShortName": {
            "value": "ops"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "1841441769041268305"
            }
          },
          "parameters": {
            "deploymentNameSuffix": {
              "type": "string"
            },
            "keyVaultPrivateDnsZoneResourceId": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "resourceGroupName": {
              "type": "string"
            },
            "subnetResourceId": {
              "type": "string"
            },
            "tags": {
              "type": "object"
            },
            "tier": {
              "type": "object"
            },
            "tokens": {
              "type": "object"
            },
            "workloadShortName": {
              "type": "string"
            }
          },
          "resources": [
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tier').subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "keyVaultName": {
                    "value": "[take(replace(parameters('tier').namingConvention.keyVault, parameters('tokens').service, ''), 24)]"
                  },
                  "keyVaultNetworkInterfaceName": {
                    "value": "[replace(parameters('tier').namingConvention.keyVaultNetworkInterface, parameters('tokens').service, '')]"
                  },
                  "keyVaultPrivateDnsZoneResourceId": {
                    "value": "[parameters('keyVaultPrivateDnsZoneResourceId')]"
                  },
                  "keyVaultPrivateEndpointName": {
                    "value": "[replace(parameters('tier').namingConvention.keyVaultPrivateEndpoint, parameters('tokens').service, '')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "subnetResourceId": {
                    "value": "[parameters('subnetResourceId')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "7405834931933819304"
                    }
                  },
                  "parameters": {
                    "diskEncryptionKeyExpirationInDays": {
                      "type": "int",
                      "defaultValue": 30
                    },
                    "keyVaultName": {
                      "type": "string"
                    },
                    "keyVaultNetworkInterfaceName": {
                      "type": "string"
                    },
                    "keyVaultPrivateDnsZoneResourceId": {
                      "type": "string"
                    },
                    "keyVaultPrivateEndpointName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "subnetResourceId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.KeyVault/vaults",
                      "apiVersion": "2022-07-01",
                      "name": "[parameters('keyVaultName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.KeyVault/vaults'), parameters('tags')['Microsoft.KeyVault/vaults'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "enabledForDeployment": false,
                        "enabledForDiskEncryption": true,
                        "enabledForTemplateDeployment": false,
                        "enablePurgeProtection": true,
                        "enableRbacAuthorization": true,
                        "enableSoftDelete": true,
                        "networkAcls": {
                          "bypass": "AzureServices",
                          "defaultAction": "Deny",
                          "ipRules": [],
                          "virtualNetworkRules": []
                        },
                        "publicNetworkAccess": "Disabled",
                        "sku": {
                          "family": "A",
                          "name": "standard"
                        },
                        "softDeleteRetentionInDays": 7,
                        "tenantId": "[subscription().tenantId]"
                      }
                    },
                    {
                      "type": "Microsoft.Network/privateEndpoints",
                      "apiVersion": "2023-04-01",
                      "name": "[parameters('keyVaultPrivateEndpointName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/privateEndpoints'), parameters('tags')['Microsoft.Network/privateEndpoints'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "customNetworkInterfaceName": "[parameters('keyVaultNetworkInterfaceName')]",
                        "privateLinkServiceConnections": [
                          {
                            "name": "[parameters('keyVaultPrivateEndpointName')]",
                            "properties": {
                              "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
                              "groupIds": [
                                "vault"
                              ]
                            }
                          }
                        ],
                        "subnet": {
                          "id": "[parameters('subnetResourceId')]"
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                      "apiVersion": "2021-08-01",
                      "name": "[format('{0}/{1}', parameters('keyVaultPrivateEndpointName'), parameters('keyVaultName'))]",
                      "properties": {
                        "privateDnsZoneConfigs": [
                          {
                            "name": "ipconfig1",
                            "properties": {
                              "privateDnsZoneId": "[parameters('keyVaultPrivateDnsZoneResourceId')]"
                            }
                          }
                        ]
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/privateEndpoints', parameters('keyVaultPrivateEndpointName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.KeyVault/vaults/keys",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', parameters('keyVaultName'), 'DiskEncryptionKey')]",
                      "properties": {
                        "attributes": {
                          "enabled": true
                        },
                        "keySize": 4096,
                        "kty": "RSA",
                        "rotationPolicy": {
                          "attributes": {
                            "expiryTime": "[format('P{0}D', string(parameters('diskEncryptionKeyExpirationInDays')))]"
                          },
                          "lifetimeActions": [
                            {
                              "action": {
                                "type": "Notify"
                              },
                              "trigger": {
                                "timeBeforeExpiry": "P10D"
                              }
                            },
                            {
                              "action": {
                                "type": "Rotate"
                              },
                              "trigger": {
                                "timeAfterCreate": "[format('P{0}D', string(sub(parameters('diskEncryptionKeyExpirationInDays'), 7)))]"
                              }
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.KeyVault/vaults/keys",
                      "apiVersion": "2022-07-01",
                      "name": "[format('{0}/{1}', parameters('keyVaultName'), 'StorageEncryptionKey')]",
                      "properties": {
                        "attributes": {
                          "enabled": true
                        },
                        "keySize": 4096,
                        "kty": "RSA",
                        "rotationPolicy": {
                          "attributes": {
                            "expiryTime": "[format('P{0}D', string(parameters('diskEncryptionKeyExpirationInDays')))]"
                          },
                          "lifetimeActions": [
                            {
                              "action": {
                                "type": "Notify"
                              },
                              "trigger": {
                                "timeBeforeExpiry": "P10D"
                              }
                            },
                            {
                              "action": {
                                "type": "Rotate"
                              },
                              "trigger": {
                                "timeAfterCreate": "[format('P{0}D', string(sub(parameters('diskEncryptionKeyExpirationInDays'), 7)))]"
                              }
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "keyUriWithVersion": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.KeyVault/vaults/keys', parameters('keyVaultName'), 'DiskEncryptionKey'), '2022-07-01').keyUriWithVersion]"
                    },
                    "keyVaultResourceId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]"
                    },
                    "keyVaultName": {
                      "type": "string",
                      "value": "[parameters('keyVaultName')]"
                    },
                    "keyVaultUri": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName')), '2022-07-01').vaultUri]"
                    },
                    "storageKeyName": {
                      "type": "string",
                      "value": "StorageEncryptionKey"
                    }
                  }
                }
              }
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-des-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tier').subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deploymentNameSuffix": {
                    "value": "[parameters('deploymentNameSuffix')]"
                  },
                  "diskEncryptionSetName": {
                    "value": "[parameters('tier').namingConvention.diskEncryptionSet]"
                  },
                  "keyUrl": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyUriWithVersion.value]"
                  },
                  "keyVaultResourceId": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultResourceId.value]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "tags": "[if(contains(parameters('tags'), 'Microsoft.Compute/diskEncryptionSets'), createObject('value', parameters('tags')['Microsoft.Compute/diskEncryptionSets']), createObject('value', createObject()))]",
                  "workloadShortName": {
                    "value": "[parameters('workloadShortName')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "7625943238700140088"
                    }
                  },
                  "parameters": {
                    "deploymentNameSuffix": {
                      "type": "string"
                    },
                    "diskEncryptionSetName": {
                      "type": "string"
                    },
                    "keyUrl": {
                      "type": "string"
                    },
                    "keyVaultResourceId": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "workloadShortName": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Compute/diskEncryptionSets",
                      "apiVersion": "2023-04-02",
                      "name": "[parameters('diskEncryptionSetName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Compute/diskEncryptionSets'), parameters('tags')['Microsoft.Compute/diskEncryptionSets'], createObject()), parameters('mlzTags'))]",
                      "identity": {
                        "type": "SystemAssigned"
                      },
                      "properties": {
                        "activeKey": {
                          "sourceVault": {
                            "id": "[parameters('keyVaultResourceId')]"
                          },
                          "keyUrl": "[parameters('keyUrl')]"
                        },
                        "encryptionType": "EncryptionAtRestWithPlatformAndCustomerKeys",
                        "rotationToLatestKeyVersionEnabled": true
                      }
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('assign-role-des-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "principalId": {
                            "value": "[reference(resourceId('Microsoft.Compute/diskEncryptionSets', parameters('diskEncryptionSetName')), '2023-04-02', 'full').identity.principalId]"
                          },
                          "principalType": {
                            "value": "ServicePrincipal"
                          },
                          "roleDefinitionId": {
                            "value": "[resourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]"
                          },
                          "targetResourceId": {
                            "value": "[resourceGroup().id]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "12311612567285718476"
                            }
                          },
                          "parameters": {
                            "targetResourceId": {
                              "type": "string"
                            },
                            "roleDefinitionId": {
                              "type": "string"
                            },
                            "principalId": {
                              "type": "string"
                            },
                            "principalType": {
                              "type": "string",
                              "defaultValue": "ServicePrincipal",
                              "allowedValues": [
                                "ForeignGroup",
                                "Group",
                                "ServicePrincipal",
                                "User"
                              ]
                            },
                            "description": {
                              "type": "string",
                              "defaultValue": ""
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Authorization/roleAssignments",
                              "apiVersion": "2020-04-01-preview",
                              "name": "[guid(parameters('targetResourceId'), parameters('roleDefinitionId'), parameters('principalId'))]",
                              "properties": {
                                "principalId": "[parameters('principalId')]",
                                "principalType": "[parameters('principalType')]",
                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
                                "description": "[parameters('description')]"
                              }
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/diskEncryptionSets', parameters('diskEncryptionSetName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "resourceId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Compute/diskEncryptionSets', parameters('diskEncryptionSetName'))]"
                    }
                  }
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix')))]"
              ]
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-id-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tier').subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "keyVaultName": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultName.value]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "userAssignedIdentityName": {
                    "value": "[replace(parameters('tier').namingConvention.userAssignedIdentity, format('-{0}', parameters('tokens').service), '')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "13565568332021378537"
                    }
                  },
                  "parameters": {
                    "keyVaultName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "userAssignedIdentityName": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
                      "apiVersion": "2018-11-30",
                      "name": "[parameters('userAssignedIdentityName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.ManagedIdentity/userAssignedIdentities'), parameters('tags')['Microsoft.ManagedIdentity/userAssignedIdentities'], createObject()), parameters('mlzTags'))]"
                    },
                    {
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2020-04-01-preview",
                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
                      "name": "[guid(parameters('userAssignedIdentityName'), 'e147488a-f6f5-4113-8e2d-b22465e65bf6', parameters('keyVaultName'))]",
                      "properties": {
                        "principalId": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName')), '2018-11-30').principalId]",
                        "principalType": "ServicePrincipal",
                        "roleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'e147488a-f6f5-4113-8e2d-b22465e65bf6')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "resourceId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('userAssignedIdentityName'))]"
                    }
                  }
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix')))]"
              ]
            }
          ],
          "outputs": {
            "diskEncryptionSetResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-des-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.resourceId.value]"
            },
            "keyVaultName": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultName.value]"
            },
            "keyVaultUri": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultUri.value]"
            },
            "keyVaultResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultResourceId.value]"
            },
            "storageKeyName": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-kv-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.storageKeyName.value]"
            },
            "userAssignedIdentityResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('tier').subscriptionId, parameters('resourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-id-{0}-{1}', parameters('workloadShortName'), parameters('deploymentNameSuffix'))), '2022-09-01').outputs.resourceId.value]"
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "deploySentinel": {
            "value": "[parameters('deploySentinel')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "logAnalyticsWorkspaceCappingDailyQuotaGb": {
            "value": "[parameters('logAnalyticsWorkspaceCappingDailyQuotaGb')]"
          },
          "logAnalyticsWorkspaceRetentionInDays": {
            "value": "[variables('logAnalyticsWorkspaceRetentionInDays')]"
          },
          "logAnalyticsWorkspaceSkuName": {
            "value": "[parameters('logAnalyticsWorkspaceSkuName')]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "ops": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value, lambda('tier', equals(lambdaVariables('tier').name, 'operations')))[0]]"
          },
          "opsResourceGroupName": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value, lambda('name', contains(lambdaVariables('name'), 'operations')))[0]]"
          },
          "privateDnsZoneResourceIds": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZoneResourceIds.value]"
          },
          "subnetResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.operationsSubnetResourceId.value]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "14902767987850828232"
            }
          },
          "parameters": {
            "deploymentNameSuffix": {
              "type": "string"
            },
            "deploySentinel": {
              "type": "bool"
            },
            "location": {
              "type": "string"
            },
            "logAnalyticsWorkspaceCappingDailyQuotaGb": {
              "type": "int"
            },
            "logAnalyticsWorkspaceRetentionInDays": {
              "type": "int"
            },
            "logAnalyticsWorkspaceSkuName": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "ops": {
              "type": "object"
            },
            "opsResourceGroupName": {
              "type": "string"
            },
            "privateDnsZoneResourceIds": {
              "type": "object"
            },
            "subnetResourceId": {
              "type": "string"
            },
            "tags": {
              "type": "object"
            }
          },
          "resources": [
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-law-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('ops').subscriptionId]",
              "resourceGroup": "[parameters('opsResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "deploySentinel": {
                    "value": "[parameters('deploySentinel')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[parameters('ops').namingConvention.logAnalyticsWorkspace]"
                  },
                  "retentionInDays": {
                    "value": "[parameters('logAnalyticsWorkspaceRetentionInDays')]"
                  },
                  "skuName": {
                    "value": "[parameters('logAnalyticsWorkspaceSkuName')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "workspaceCappingDailyQuotaGb": {
                    "value": "[parameters('logAnalyticsWorkspaceCappingDailyQuotaGb')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "5539720902626713197"
                    }
                  },
                  "parameters": {
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "name": {
                      "type": "string"
                    },
                    "retentionInDays": {
                      "type": "int",
                      "defaultValue": 30
                    },
                    "skuName": {
                      "type": "string",
                      "defaultValue": "PerGB2018"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "workspaceCappingDailyQuotaGb": {
                      "type": "int",
                      "defaultValue": -1
                    },
                    "deploySentinel": {
                      "type": "bool",
                      "defaultValue": false,
                      "metadata": {
                        "description": "Whether or not to deploy Sentinel solution to workspace."
                      }
                    }
                  },
                  "variables": {
                    "solutions": [
                      {
                        "deploy": true,
                        "name": "AzureActivity",
                        "product": "OMSGallery/AzureActivity",
                        "publisher": "Microsoft",
                        "promotionCode": ""
                      },
                      {
                        "deploy": "[parameters('deploySentinel')]",
                        "name": "SecurityInsights",
                        "product": "OMSGallery/SecurityInsights",
                        "publisher": "Microsoft",
                        "promotionCode": ""
                      },
                      {
                        "deploy": true,
                        "name": "VMInsights",
                        "product": "OMSGallery/VMInsights",
                        "publisher": "Microsoft",
                        "promotionCode": ""
                      },
                      {
                        "deploy": true,
                        "name": "Security",
                        "product": "OMSGallery/Security",
                        "publisher": "Microsoft",
                        "promotionCode": ""
                      },
                      {
                        "deploy": true,
                        "name": "ServiceMap",
                        "publisher": "Microsoft",
                        "product": "OMSGallery/ServiceMap",
                        "promotionCode": ""
                      },
                      {
                        "deploy": true,
                        "name": "ContainerInsights",
                        "publisher": "Microsoft",
                        "product": "OMSGallery/ContainerInsights",
                        "promotionCode": ""
                      },
                      {
                        "deploy": true,
                        "name": "KeyVaultAnalytics",
                        "publisher": "Microsoft",
                        "product": "OMSGallery/KeyVaultAnalytics",
                        "promotionCode": ""
                      }
                    ]
                  },
                  "resources": [
                    {
                      "type": "Microsoft.OperationalInsights/workspaces",
                      "apiVersion": "2021-06-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.OperationalInsights/workspaces'), parameters('tags')['Microsoft.OperationalInsights/workspaces'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "retentionInDays": "[parameters('retentionInDays')]",
                        "sku": {
                          "name": "[parameters('skuName')]"
                        },
                        "workspaceCapping": {
                          "dailyQuotaGb": "[parameters('workspaceCappingDailyQuotaGb')]"
                        },
                        "publicNetworkAccessForIngestion": "Enabled",
                        "publicNetworkAccessForQuery": "Enabled"
                      }
                    },
                    {
                      "copy": {
                        "name": "logAnalyticsSolutions",
                        "count": "[length(variables('solutions'))]"
                      },
                      "condition": "[variables('solutions')[copyIndex()].deploy]",
                      "type": "Microsoft.OperationsManagement/solutions",
                      "apiVersion": "2015-11-01-preview",
                      "name": "[format('{0}({1})', variables('solutions')[copyIndex()].name, parameters('name'))]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.OperationsManagement/solutions'), parameters('tags')['Microsoft.OperationsManagement/solutions'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "workspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
                      },
                      "plan": {
                        "name": "[format('{0}({1})', variables('solutions')[copyIndex()].name, parameters('name'))]",
                        "product": "[variables('solutions')[copyIndex()].product]",
                        "publisher": "[variables('solutions')[copyIndex()].publisher]",
                        "promotionCode": "[variables('solutions')[copyIndex()].promotionCode]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "resourceId": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('name'))]"
                    }
                  }
                }
              }
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-private-link-scope-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('ops').subscriptionId]",
              "resourceGroup": "[parameters('opsResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('ops').subscriptionId, parameters('opsResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-law-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.resourceId.value]"
                  },
                  "name": {
                    "value": "[parameters('ops').namingConvention.privateLinkScope]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "9577620097693027793"
                    }
                  },
                  "parameters": {
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "name": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "microsoft.insights/privateLinkScopes",
                      "apiVersion": "2021-09-01",
                      "name": "[parameters('name')]",
                      "location": "global",
                      "properties": {
                        "accessModeSettings": {
                          "ingestionAccessMode": "PrivateOnly",
                          "queryAccessMode": "PrivateOnly"
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Insights/privateLinkScopes/scopedResources",
                      "apiVersion": "2021-09-01",
                      "name": "[format('{0}/{1}', parameters('name'), split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])]",
                      "properties": {
                        "linkedResourceId": "[parameters('logAnalyticsWorkspaceResourceId')]"
                      },
                      "dependsOn": [
                        "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "resourceId": {
                      "type": "string",
                      "value": "[resourceId('microsoft.insights/privateLinkScopes', parameters('name'))]"
                    }
                  }
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('ops').subscriptionId, parameters('opsResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-law-{0}', parameters('deploymentNameSuffix')))]"
              ]
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-private-endpoint-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('ops').subscriptionId]",
              "resourceGroup": "[parameters('opsResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "groupIds": {
                    "value": [
                      "azuremonitor"
                    ]
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[parameters('ops').namingConvention.privateLinkScopePrivateEndpoint]"
                  },
                  "networkInterfaceName": {
                    "value": "[parameters('ops').namingConvention.privateLinkScopeNetworkInterface]"
                  },
                  "privateDnsZoneConfigs": {
                    "value": [
                      {
                        "name": "monitor",
                        "properties": {
                          "privateDnsZoneId": "[parameters('privateDnsZoneResourceIds').monitor]"
                        }
                      },
                      {
                        "name": "oms",
                        "properties": {
                          "privateDnsZoneId": "[parameters('privateDnsZoneResourceIds').oms]"
                        }
                      },
                      {
                        "name": "ods",
                        "properties": {
                          "privateDnsZoneId": "[parameters('privateDnsZoneResourceIds').ods]"
                        }
                      },
                      {
                        "name": "agentsvc",
                        "properties": {
                          "privateDnsZoneId": "[parameters('privateDnsZoneResourceIds').agentsvc]"
                        }
                      },
                      {
                        "name": "blob",
                        "properties": {
                          "privateDnsZoneId": "[parameters('privateDnsZoneResourceIds').blob]"
                        }
                      }
                    ]
                  },
                  "privateLinkServiceId": {
                    "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('ops').subscriptionId, parameters('opsResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-private-link-scope-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.resourceId.value]"
                  },
                  "subnetResourceId": {
                    "value": "[parameters('subnetResourceId')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "1001119387460752288"
                    }
                  },
                  "parameters": {
                    "groupIds": {
                      "type": "array"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "name": {
                      "type": "string"
                    },
                    "networkInterfaceName": {
                      "type": "string"
                    },
                    "privateDnsZoneConfigs": {
                      "type": "array"
                    },
                    "privateLinkServiceId": {
                      "type": "string"
                    },
                    "subnetResourceId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/privateEndpoints",
                      "apiVersion": "2023-04-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/privateEndpoints'), parameters('tags')['Microsoft.Network/privateEndpoints'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "customNetworkInterfaceName": "[parameters('networkInterfaceName')]",
                        "privateLinkServiceConnections": [
                          {
                            "name": "[parameters('name')]",
                            "properties": {
                              "privateLinkServiceId": "[parameters('privateLinkServiceId')]",
                              "groupIds": "[parameters('groupIds')]"
                            }
                          }
                        ],
                        "subnet": {
                          "id": "[parameters('subnetResourceId')]"
                        }
                      }
                    },
                    {
                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                      "apiVersion": "2023-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), parameters('name'))]",
                      "properties": {
                        "privateDnsZoneConfigs": "[parameters('privateDnsZoneConfigs')]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/privateEndpoints', parameters('name'))]"
                      ]
                    }
                  ]
                }
              },
              "dependsOn": [
                "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('ops').subscriptionId, parameters('opsResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-private-link-scope-{0}', parameters('deploymentNameSuffix')))]"
              ]
            }
          ],
          "outputs": {
            "logAnalyticsWorkspaceResourceId": {
              "type": "string",
              "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', parameters('ops').subscriptionId, parameters('opsResourceGroupName')), 'Microsoft.Resources/deployments', format('deploy-law-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.resourceId.value]"
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-remote-access-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "bastionHostPublicIPAddressAllocationMethod": {
            "value": "Static"
          },
          "bastionHostPublicIPAddressAvailabilityZones": {
            "value": "[parameters('bastionHostPublicIPAddressAvailabilityZones')]"
          },
          "bastionHostPublicIPAddressSkuName": {
            "value": "Standard"
          },
          "bastionHostSubnetResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.bastionHostSubnetResourceId.value]"
          },
          "deployBastion": {
            "value": "[parameters('deployBastion')]"
          },
          "deployLinuxVirtualMachine": {
            "value": "[parameters('deployLinuxVirtualMachine')]"
          },
          "deployWindowsVirtualMachine": {
            "value": "[parameters('deployWindowsVirtualMachine')]"
          },
          "diskEncryptionSetResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.diskEncryptionSetResourceId.value]"
          },
          "hub": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value, lambda('tier', equals(lambdaVariables('tier').name, 'hub')))[0]]"
          },
          "hubNetworkSecurityGroupResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.hubNetworkSecurityGroupResourceId.value]"
          },
          "hubResourceGroupName": {
            "value": "[filter(reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value, lambda('name', contains(lambdaVariables('name'), 'hub')))[0]]"
          },
          "hubSubnetResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.hubSubnetResourceId.value]"
          },
          "hybridUseBenefit": {
            "value": "[parameters('hybridUseBenefit')]"
          },
          "linuxNetworkInterfacePrivateIPAddressAllocationMethod": {
            "value": "[parameters('linuxNetworkInterfacePrivateIPAddressAllocationMethod')]"
          },
          "linuxVmAdminPasswordOrKey": {
            "value": "[parameters('linuxVmAdminPasswordOrKey')]"
          },
          "linuxVmAdminUsername": {
            "value": "[parameters('linuxVmAdminUsername')]"
          },
          "linuxVmAuthenticationType": {
            "value": "[parameters('linuxVmAuthenticationType')]"
          },
          "linuxVmImageOffer": {
            "value": "[parameters('linuxVmImageOffer')]"
          },
          "linuxVmImagePublisher": {
            "value": "[parameters('linuxVmImagePublisher')]"
          },
          "linuxVmImageSku": {
            "value": "[parameters('linuxVmImageSku')]"
          },
          "linuxVmImageVersion": {
            "value": "[parameters('linuxVmImageVersion')]"
          },
          "linuxVmOsDiskCreateOption": {
            "value": "[parameters('linuxVmOsDiskCreateOption')]"
          },
          "linuxVmOsDiskType": {
            "value": "[parameters('linuxVmOsDiskType')]"
          },
          "linuxVmSize": {
            "value": "[parameters('linuxVmSize')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "logAnalyticsWorkspaceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.logAnalyticsWorkspaceResourceId.value]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "serviceToken": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tokens.value.service]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          },
          "windowsNetworkInterfacePrivateIPAddressAllocationMethod": {
            "value": "[parameters('windowsNetworkInterfacePrivateIPAddressAllocationMethod')]"
          },
          "windowsVmAdminPassword": {
            "value": "[parameters('windowsVmAdminPassword')]"
          },
          "windowsVmAdminUsername": {
            "value": "[parameters('windowsVmAdminUsername')]"
          },
          "windowsVmCreateOption": {
            "value": "[parameters('windowsVmCreateOption')]"
          },
          "windowsVmOffer": {
            "value": "[parameters('windowsVmOffer')]"
          },
          "windowsVmPublisher": {
            "value": "[parameters('windowsVmPublisher')]"
          },
          "windowsVmSize": {
            "value": "[parameters('windowsVmSize')]"
          },
          "windowsVmSku": {
            "value": "[parameters('windowsVmSku')]"
          },
          "windowsVmStorageAccountType": {
            "value": "[parameters('windowsVmStorageAccountType')]"
          },
          "windowsVmVersion": {
            "value": "[parameters('windowsVmVersion')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "6708970786384964546"
            }
          },
          "parameters": {
            "bastionHostPublicIPAddressAllocationMethod": {
              "type": "string"
            },
            "bastionHostPublicIPAddressAvailabilityZones": {
              "type": "array"
            },
            "bastionHostPublicIPAddressSkuName": {
              "type": "string"
            },
            "bastionHostSubnetResourceId": {
              "type": "string"
            },
            "deployBastion": {
              "type": "bool"
            },
            "deployLinuxVirtualMachine": {
              "type": "bool"
            },
            "deployWindowsVirtualMachine": {
              "type": "bool"
            },
            "diskEncryptionSetResourceId": {
              "type": "string"
            },
            "hub": {
              "type": "object"
            },
            "hubNetworkSecurityGroupResourceId": {
              "type": "string"
            },
            "hubResourceGroupName": {
              "type": "string"
            },
            "hubSubnetResourceId": {
              "type": "string"
            },
            "hybridUseBenefit": {
              "type": "bool"
            },
            "linuxNetworkInterfacePrivateIPAddressAllocationMethod": {
              "type": "string"
            },
            "linuxVmAdminPasswordOrKey": {
              "type": "securestring",
              "minLength": 12
            },
            "linuxVmAdminUsername": {
              "type": "string"
            },
            "linuxVmAuthenticationType": {
              "type": "string",
              "allowedValues": [
                "sshPublicKey",
                "password"
              ]
            },
            "linuxVmImageOffer": {
              "type": "string"
            },
            "linuxVmImagePublisher": {
              "type": "string"
            },
            "linuxVmImageSku": {
              "type": "string"
            },
            "linuxVmImageVersion": {
              "type": "string"
            },
            "linuxVmOsDiskCreateOption": {
              "type": "string"
            },
            "linuxVmOsDiskType": {
              "type": "string"
            },
            "linuxVmSize": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "logAnalyticsWorkspaceId": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "serviceToken": {
              "type": "string"
            },
            "tags": {
              "type": "object"
            },
            "windowsNetworkInterfacePrivateIPAddressAllocationMethod": {
              "type": "string"
            },
            "windowsVmAdminPassword": {
              "type": "securestring",
              "minLength": 12
            },
            "windowsVmAdminUsername": {
              "type": "string"
            },
            "windowsVmCreateOption": {
              "type": "string"
            },
            "windowsVmOffer": {
              "type": "string"
            },
            "windowsVmPublisher": {
              "type": "string"
            },
            "windowsVmSize": {
              "type": "string"
            },
            "windowsVmSku": {
              "type": "string"
            },
            "windowsVmStorageAccountType": {
              "type": "string"
            },
            "windowsVmVersion": {
              "type": "string"
            }
          },
          "resources": [
            {
              "condition": "[parameters('deployBastion')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "remoteAccess-bastionHost",
              "subscriptionId": "[parameters('hub').subscriptionId]",
              "resourceGroup": "[parameters('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "bastionHostSubnetResourceId": {
                    "value": "[parameters('bastionHostSubnetResourceId')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[parameters('hub').namingConvention.bastionHost]"
                  },
                  "publicIPAddressAllocationMethod": {
                    "value": "[parameters('bastionHostPublicIPAddressAllocationMethod')]"
                  },
                  "publicIPAddressAvailabilityZones": {
                    "value": "[parameters('bastionHostPublicIPAddressAvailabilityZones')]"
                  },
                  "publicIPAddressName": {
                    "value": "[parameters('hub').namingConvention.bastionHostPublicIPAddress]"
                  },
                  "publicIPAddressSkuName": {
                    "value": "[parameters('bastionHostPublicIPAddressSkuName')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "47445093408639910"
                    }
                  },
                  "parameters": {
                    "bastionHostSubnetResourceId": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "name": {
                      "type": "string"
                    },
                    "publicIPAddressAllocationMethod": {
                      "type": "string"
                    },
                    "publicIPAddressAvailabilityZones": {
                      "type": "array"
                    },
                    "publicIPAddressName": {
                      "type": "string"
                    },
                    "publicIPAddressSkuName": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Network/publicIPAddresses",
                      "apiVersion": "2021-02-01",
                      "name": "[parameters('publicIPAddressName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/publicIPAddresses'), parameters('tags')['Microsoft.Network/publicIPAddresses'], createObject()), parameters('mlzTags'))]",
                      "sku": {
                        "name": "[parameters('publicIPAddressSkuName')]"
                      },
                      "properties": {
                        "publicIPAllocationMethod": "[parameters('publicIPAddressAllocationMethod')]"
                      },
                      "zones": "[parameters('publicIPAddressAvailabilityZones')]"
                    },
                    {
                      "type": "Microsoft.Network/bastionHosts",
                      "apiVersion": "2021-02-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/bastionHosts'), parameters('tags')['Microsoft.Network/bastionHosts'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "ipConfigurations": [
                          {
                            "name": "ipconfig",
                            "properties": {
                              "subnet": {
                                "id": "[parameters('bastionHostSubnetResourceId')]"
                              },
                              "publicIPAddress": {
                                "id": "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddressName'))]"
                              }
                            }
                          }
                        ]
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/publicIPAddresses', parameters('publicIPAddressName'))]"
                      ]
                    }
                  ]
                }
              }
            },
            {
              "condition": "[parameters('deployLinuxVirtualMachine')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "remoteAccess-linuxVirtualMachine",
              "subscriptionId": "[parameters('hub').subscriptionId]",
              "resourceGroup": "[parameters('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "adminPasswordOrKey": {
                    "value": "[parameters('linuxVmAdminPasswordOrKey')]"
                  },
                  "adminUsername": {
                    "value": "[parameters('linuxVmAdminUsername')]"
                  },
                  "authenticationType": {
                    "value": "[parameters('linuxVmAuthenticationType')]"
                  },
                  "diskEncryptionSetResourceId": {
                    "value": "[parameters('diskEncryptionSetResourceId')]"
                  },
                  "diskName": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachineDisk, parameters('serviceToken'), 'remoteAccess-linux')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "logAnalyticsWorkspaceId": {
                    "value": "[parameters('logAnalyticsWorkspaceId')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachine, parameters('serviceToken'), 'ral')]"
                  },
                  "networkInterfaceName": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachineNetworkInterface, parameters('serviceToken'), 'remoteAccess-linux')]"
                  },
                  "networkSecurityGroupResourceId": {
                    "value": "[parameters('hubNetworkSecurityGroupResourceId')]"
                  },
                  "osDiskCreateOption": {
                    "value": "[parameters('linuxVmOsDiskCreateOption')]"
                  },
                  "osDiskType": {
                    "value": "[parameters('linuxVmOsDiskType')]"
                  },
                  "privateIPAddressAllocationMethod": {
                    "value": "[parameters('linuxNetworkInterfacePrivateIPAddressAllocationMethod')]"
                  },
                  "subnetResourceId": {
                    "value": "[parameters('hubSubnetResourceId')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "vmImageOffer": {
                    "value": "[parameters('linuxVmImageOffer')]"
                  },
                  "vmImagePublisher": {
                    "value": "[parameters('linuxVmImagePublisher')]"
                  },
                  "vmImageSku": {
                    "value": "[parameters('linuxVmImageSku')]"
                  },
                  "vmImageVersion": {
                    "value": "[parameters('linuxVmImageVersion')]"
                  },
                  "vmSize": {
                    "value": "[parameters('linuxVmSize')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "1869178117782936495"
                    }
                  },
                  "parameters": {
                    "adminPasswordOrKey": {
                      "type": "securestring",
                      "minLength": 12
                    },
                    "adminUsername": {
                      "type": "string"
                    },
                    "authenticationType": {
                      "type": "string",
                      "allowedValues": [
                        "sshPublicKey",
                        "password"
                      ]
                    },
                    "diskEncryptionSetResourceId": {
                      "type": "string"
                    },
                    "diskName": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceId": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "name": {
                      "type": "string"
                    },
                    "networkInterfaceName": {
                      "type": "string"
                    },
                    "networkSecurityGroupResourceId": {
                      "type": "string"
                    },
                    "osDiskCreateOption": {
                      "type": "string"
                    },
                    "osDiskType": {
                      "type": "string"
                    },
                    "privateIPAddressAllocationMethod": {
                      "type": "string"
                    },
                    "subnetResourceId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "vmImageOffer": {
                      "type": "string"
                    },
                    "vmImagePublisher": {
                      "type": "string"
                    },
                    "vmImageSku": {
                      "type": "string"
                    },
                    "vmImageVersion": {
                      "type": "string"
                    },
                    "vmSize": {
                      "type": "string"
                    }
                  },
                  "variables": {
                    "linuxConfiguration": {
                      "disablePasswordAuthentication": true,
                      "ssh": {
                        "publicKeys": [
                          {
                            "path": "[format('/home/{0}/.ssh/authorized_keys', parameters('adminUsername'))]",
                            "keyData": "[parameters('adminPasswordOrKey')]"
                          }
                        ]
                      }
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Compute/virtualMachines",
                      "apiVersion": "2021-04-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Compute/virtualMachines'), parameters('tags')['Microsoft.Compute/virtualMachines'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "diagnosticsProfile": {
                          "bootDiagnostics": {
                            "enabled": false
                          }
                        },
                        "hardwareProfile": {
                          "vmSize": "[parameters('vmSize')]"
                        },
                        "networkProfile": {
                          "networkInterfaces": [
                            {
                              "id": "[reference(resourceId('Microsoft.Resources/deployments', 'remoteAccess-linuxNetworkInterface'), '2022-09-01').outputs.id.value]",
                              "properties": {
                                "deleteOption": "Delete"
                              }
                            }
                          ]
                        },
                        "osProfile": {
                          "computerName": "[parameters('name')]",
                          "adminUsername": "[parameters('adminUsername')]",
                          "adminPassword": "[parameters('adminPasswordOrKey')]",
                          "linuxConfiguration": "[if(equals(parameters('authenticationType'), 'password'), null(), variables('linuxConfiguration'))]"
                        },
                        "securityProfile": {
                          "uefiSettings": {
                            "secureBootEnabled": true,
                            "vTpmEnabled": true
                          },
                          "securityType": "trustedLaunch",
                          "encryptionAtHost": true
                        },
                        "storageProfile": {
                          "osDisk": {
                            "caching": "ReadWrite",
                            "createOption": "[parameters('osDiskCreateOption')]",
                            "deleteOption": "Delete",
                            "managedDisk": {
                              "diskEncryptionSet": {
                                "id": "[parameters('diskEncryptionSetResourceId')]"
                              },
                              "storageAccountType": "[parameters('osDiskType')]"
                            },
                            "name": "[parameters('diskName')]",
                            "osType": "Linux"
                          },
                          "imageReference": {
                            "publisher": "[parameters('vmImagePublisher')]",
                            "offer": "[parameters('vmImageOffer')]",
                            "sku": "[parameters('vmImageSku')]",
                            "version": "[parameters('vmImageVersion')]"
                          }
                        },
                        "licenseType": null
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Resources/deployments', 'remoteAccess-linuxNetworkInterface')]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-03-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'GuestAttestation')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.Security.LinuxAttestation",
                        "type": "GuestAttestation",
                        "typeHandlerVersion": "1.0",
                        "autoUpgradeMinorVersion": true,
                        "settings": {
                          "AttestationConfig": {
                            "MaaSettings": {
                              "maaEndpoint": "",
                              "maaTenantName": "GuestAttestation"
                            },
                            "AscSettings": {
                              "ascReportingEndpoint": "",
                              "ascReportingFrequency": ""
                            },
                            "useCustomToken": "false",
                            "disableAlerts": "false"
                          }
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'AzurePolicyforLinux')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.GuestConfiguration",
                        "type": "ConfigurationforLinux",
                        "typeHandlerVersion": "1.0",
                        "autoUpgradeMinorVersion": true,
                        "enableAutomaticUpgrade": true
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'Microsoft.Azure.NetworkWatcher')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.NetworkWatcher",
                        "type": "NetworkWatcherAgentLinux",
                        "typeHandlerVersion": "1.4"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('name'), 'AzurePolicyforLinux')]",
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2020-06-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'OMSExtension')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.EnterpriseCloud.Monitoring",
                        "type": "OmsAgentForLinux",
                        "typeHandlerVersion": "1.19",
                        "settings": {
                          "workspaceId": "[reference(parameters('logAnalyticsWorkspaceId'), '2015-11-01-preview').customerId]",
                          "stopOnMultipleConnections": true
                        },
                        "protectedSettings": {
                          "workspaceKey": "[listKeys(parameters('logAnalyticsWorkspaceId'), '2015-11-01-preview').primarySharedKey]"
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('name'), 'Microsoft.Azure.NetworkWatcher')]",
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'DependencyAgentLinux')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.Monitoring.DependencyAgent",
                        "type": "DependencyAgentLinux",
                        "typeHandlerVersion": "9.5",
                        "autoUpgradeMinorVersion": true
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines/extensions', parameters('name'), 'OMSExtension')]",
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "remoteAccess-linuxNetworkInterface",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkInterfaceName')]"
                          },
                          "networkSecurityGroupResourceId": {
                            "value": "[parameters('networkSecurityGroupResourceId')]"
                          },
                          "privateIPAddressAllocationMethod": {
                            "value": "[parameters('privateIPAddressAllocationMethod')]"
                          },
                          "subnetResourceId": {
                            "value": "[parameters('subnetResourceId')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "2480907514265648057"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object",
                              "defaultValue": {}
                            },
                            "name": {
                              "type": "string"
                            },
                            "networkSecurityGroupResourceId": {
                              "type": "string"
                            },
                            "privateIPAddressAllocationMethod": {
                              "type": "string"
                            },
                            "subnetResourceId": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object",
                              "defaultValue": {}
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkInterfaces",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkInterfaces'), parameters('tags')['Microsoft.Network/networkInterfaces'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "ipConfigurations": [
                                  {
                                    "name": "ipconfig",
                                    "properties": {
                                      "subnet": {
                                        "id": "[parameters('subnetResourceId')]"
                                      },
                                      "privateIPAllocationMethod": "[parameters('privateIPAddressAllocationMethod')]"
                                    }
                                  }
                                ],
                                "networkSecurityGroup": {
                                  "id": "[parameters('networkSecurityGroupResourceId')]"
                                }
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    }
                  ],
                  "outputs": {
                    "adminUsername": {
                      "type": "string",
                      "value": "[parameters('adminUsername')]"
                    },
                    "authenticationType": {
                      "type": "string",
                      "value": "[parameters('authenticationType')]"
                    }
                  }
                }
              }
            },
            {
              "condition": "[parameters('deployWindowsVirtualMachine')]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "remoteAccess-windowsVirtualMachine",
              "subscriptionId": "[parameters('hub').subscriptionId]",
              "resourceGroup": "[parameters('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "adminPassword": {
                    "value": "[parameters('windowsVmAdminPassword')]"
                  },
                  "adminUsername": {
                    "value": "[parameters('windowsVmAdminUsername')]"
                  },
                  "createOption": {
                    "value": "[parameters('windowsVmCreateOption')]"
                  },
                  "diskEncryptionSetResourceId": {
                    "value": "[parameters('diskEncryptionSetResourceId')]"
                  },
                  "diskName": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachineDisk, parameters('serviceToken'), 'remoteAccess-windows')]"
                  },
                  "hybridUseBenefit": {
                    "value": "[parameters('hybridUseBenefit')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "logAnalyticsWorkspaceId": {
                    "value": "[parameters('logAnalyticsWorkspaceId')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "name": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachine, parameters('serviceToken'), 'raw')]"
                  },
                  "networkInterfaceName": {
                    "value": "[replace(parameters('hub').namingConvention.virtualMachineNetworkInterface, parameters('serviceToken'), 'remoteAccess-windows')]"
                  },
                  "networkSecurityGroupResourceId": {
                    "value": "[parameters('hubNetworkSecurityGroupResourceId')]"
                  },
                  "offer": {
                    "value": "[parameters('windowsVmOffer')]"
                  },
                  "privateIPAddressAllocationMethod": {
                    "value": "[parameters('windowsNetworkInterfacePrivateIPAddressAllocationMethod')]"
                  },
                  "publisher": {
                    "value": "[parameters('windowsVmPublisher')]"
                  },
                  "size": {
                    "value": "[parameters('windowsVmSize')]"
                  },
                  "sku": {
                    "value": "[parameters('windowsVmSku')]"
                  },
                  "storageAccountType": {
                    "value": "[parameters('windowsVmStorageAccountType')]"
                  },
                  "subnetResourceId": {
                    "value": "[parameters('hubSubnetResourceId')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "version": {
                    "value": "[parameters('windowsVmVersion')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "16560660944283587014"
                    }
                  },
                  "parameters": {
                    "adminPassword": {
                      "type": "securestring",
                      "minLength": 12
                    },
                    "adminUsername": {
                      "type": "string"
                    },
                    "createOption": {
                      "type": "string"
                    },
                    "dataDisks": {
                      "type": "array",
                      "defaultValue": []
                    },
                    "diskEncryptionSetResourceId": {
                      "type": "string"
                    },
                    "diskName": {
                      "type": "string"
                    },
                    "hybridUseBenefit": {
                      "type": "bool"
                    },
                    "location": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceId": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object",
                      "defaultValue": {}
                    },
                    "name": {
                      "type": "string"
                    },
                    "networkInterfaceName": {
                      "type": "string"
                    },
                    "networkSecurityGroupResourceId": {
                      "type": "string"
                    },
                    "offer": {
                      "type": "string"
                    },
                    "privateIPAddressAllocationMethod": {
                      "type": "string"
                    },
                    "publisher": {
                      "type": "string"
                    },
                    "size": {
                      "type": "string"
                    },
                    "sku": {
                      "type": "string"
                    },
                    "storageAccountType": {
                      "type": "string"
                    },
                    "subnetResourceId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object",
                      "defaultValue": {}
                    },
                    "version": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Compute/virtualMachines",
                      "apiVersion": "2021-04-01",
                      "name": "[parameters('name')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Compute/virtualMachines'), parameters('tags')['Microsoft.Compute/virtualMachines'], createObject()), parameters('mlzTags'))]",
                      "identity": {
                        "type": "SystemAssigned"
                      },
                      "properties": {
                        "diagnosticsProfile": {
                          "bootDiagnostics": {
                            "enabled": false
                          }
                        },
                        "hardwareProfile": {
                          "vmSize": "[parameters('size')]"
                        },
                        "networkProfile": {
                          "networkInterfaces": [
                            {
                              "id": "[reference(resourceId('Microsoft.Resources/deployments', 'remoteAccess-windowsNetworkInterface'), '2022-09-01').outputs.id.value]",
                              "properties": {
                                "deleteOption": "Delete"
                              }
                            }
                          ]
                        },
                        "osProfile": {
                          "computerName": "[take(parameters('name'), 15)]",
                          "adminUsername": "[parameters('adminUsername')]",
                          "adminPassword": "[parameters('adminPassword')]"
                        },
                        "securityProfile": {
                          "uefiSettings": {
                            "secureBootEnabled": true,
                            "vTpmEnabled": true
                          },
                          "securityType": "trustedLaunch",
                          "encryptionAtHost": true
                        },
                        "storageProfile": {
                          "imageReference": {
                            "publisher": "[parameters('publisher')]",
                            "offer": "[parameters('offer')]",
                            "sku": "[parameters('sku')]",
                            "version": "[parameters('version')]"
                          },
                          "osDisk": {
                            "caching": "ReadWrite",
                            "createOption": "[parameters('createOption')]",
                            "deleteOption": "Delete",
                            "managedDisk": {
                              "diskEncryptionSet": {
                                "id": "[parameters('diskEncryptionSetResourceId')]"
                              },
                              "storageAccountType": "[parameters('storageAccountType')]"
                            },
                            "name": "[parameters('diskName')]",
                            "osType": "Windows"
                          },
                          "dataDisks": "[parameters('dataDisks')]"
                        },
                        "licenseType": "[if(parameters('hybridUseBenefit'), 'Windows_Server', null())]"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Resources/deployments', 'remoteAccess-windowsNetworkInterface')]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-03-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'GuestAttestation')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.Security.WindowsAttestation",
                        "type": "GuestAttestation",
                        "typeHandlerVersion": "1.0",
                        "autoUpgradeMinorVersion": true,
                        "settings": {
                          "AttestationConfig": {
                            "MaaSettings": {
                              "maaEndpoint": "",
                              "maaTenantName": "GuestAttestation"
                            },
                            "AscSettings": {
                              "ascReportingEndpoint": "",
                              "ascReportingFrequency": ""
                            },
                            "useCustomToken": "false",
                            "disableAlerts": "false"
                          }
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'DependencyAgentWindows')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.Monitoring.DependencyAgent",
                        "type": "DependencyAgentWindows",
                        "typeHandlerVersion": "9.5",
                        "autoUpgradeMinorVersion": true
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'AzurePolicyforWindows')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.GuestConfiguration",
                        "type": "ConfigurationforWindows",
                        "typeHandlerVersion": "1.0",
                        "autoUpgradeMinorVersion": true,
                        "enableAutomaticUpgrade": true
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'MMAExtension')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.EnterpriseCloud.Monitoring",
                        "type": "MicrosoftMonitoringAgent",
                        "typeHandlerVersion": "1.0",
                        "settings": {
                          "workspaceId": "[reference(parameters('logAnalyticsWorkspaceId'), '2015-11-01-preview').customerId]",
                          "stopOnMultipleConnections": true
                        },
                        "protectedSettings": {
                          "workspaceKey": "[listKeys(parameters('logAnalyticsWorkspaceId'), '2015-11-01-preview').primarySharedKey]"
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Compute/virtualMachines/extensions",
                      "apiVersion": "2021-04-01",
                      "name": "[format('{0}/{1}', parameters('name'), 'Microsoft.Azure.NetworkWatcher')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "publisher": "Microsoft.Azure.NetworkWatcher",
                        "type": "NetworkWatcherAgentWindows",
                        "typeHandlerVersion": "1.4"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Compute/virtualMachines', parameters('name'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "remoteAccess-windowsNetworkInterface",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "location": {
                            "value": "[parameters('location')]"
                          },
                          "mlzTags": {
                            "value": "[parameters('mlzTags')]"
                          },
                          "name": {
                            "value": "[parameters('networkInterfaceName')]"
                          },
                          "networkSecurityGroupResourceId": {
                            "value": "[parameters('networkSecurityGroupResourceId')]"
                          },
                          "privateIPAddressAllocationMethod": {
                            "value": "[parameters('privateIPAddressAllocationMethod')]"
                          },
                          "subnetResourceId": {
                            "value": "[parameters('subnetResourceId')]"
                          },
                          "tags": {
                            "value": "[parameters('tags')]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "2480907514265648057"
                            }
                          },
                          "parameters": {
                            "location": {
                              "type": "string"
                            },
                            "mlzTags": {
                              "type": "object",
                              "defaultValue": {}
                            },
                            "name": {
                              "type": "string"
                            },
                            "networkSecurityGroupResourceId": {
                              "type": "string"
                            },
                            "privateIPAddressAllocationMethod": {
                              "type": "string"
                            },
                            "subnetResourceId": {
                              "type": "string"
                            },
                            "tags": {
                              "type": "object",
                              "defaultValue": {}
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Network/networkInterfaces",
                              "apiVersion": "2021-02-01",
                              "name": "[parameters('name')]",
                              "location": "[parameters('location')]",
                              "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/networkInterfaces'), parameters('tags')['Microsoft.Network/networkInterfaces'], createObject()), parameters('mlzTags'))]",
                              "properties": {
                                "ipConfigurations": [
                                  {
                                    "name": "ipconfig",
                                    "properties": {
                                      "subnet": {
                                        "id": "[parameters('subnetResourceId')]"
                                      },
                                      "privateIPAllocationMethod": "[parameters('privateIPAddressAllocationMethod')]"
                                    }
                                  }
                                ],
                                "networkSecurityGroup": {
                                  "id": "[parameters('networkSecurityGroupResourceId')]"
                                }
                              }
                            }
                          ],
                          "outputs": {
                            "id": {
                              "type": "string",
                              "value": "[resourceId('Microsoft.Network/networkInterfaces', parameters('name'))]"
                            },
                            "name": {
                              "type": "string",
                              "value": "[parameters('name')]"
                            }
                          }
                        }
                      }
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-log-storage-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "blobsPrivateDnsZoneResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZoneResourceIds.value.blob]"
          },
          "deployIdentity": {
            "value": "[parameters('deployIdentity')]"
          },
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "keyVaultUri": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultUri.value]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "logStorageSkuName": {
            "value": "[parameters('logStorageSkuName')]"
          },
          "mlzTags": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.mlzTags.value]"
          },
          "resourceGroupNames": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value]"
          },
          "serviceToken": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tokens.value.service]"
          },
          "storageEncryptionKeyName": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.storageKeyName.value]"
          },
          "tablesPrivateDnsZoneResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.privateDnsZoneResourceIds.value.table]"
          },
          "tags": {
            "value": "[parameters('tags')]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          },
          "userAssignedIdentityResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.userAssignedIdentityResourceId.value]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "602947614524371093"
            }
          },
          "parameters": {
            "blobsPrivateDnsZoneResourceId": {
              "type": "string"
            },
            "deployIdentity": {
              "type": "bool"
            },
            "deploymentNameSuffix": {
              "type": "string"
            },
            "keyVaultUri": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "logStorageSkuName": {
              "type": "string"
            },
            "mlzTags": {
              "type": "object"
            },
            "resourceGroupNames": {
              "type": "array"
            },
            "serviceToken": {
              "type": "string"
            },
            "storageEncryptionKeyName": {
              "type": "string"
            },
            "tablesPrivateDnsZoneResourceId": {
              "type": "string"
            },
            "tags": {
              "type": "object"
            },
            "tiers": {
              "type": "array"
            },
            "userAssignedIdentityResourceId": {
              "type": "string"
            }
          },
          "resources": [
            {
              "copy": {
                "name": "storageAccount",
                "count": "[length(parameters('tiers'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-storage-account-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupNames')[copyIndex()]]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "blobsPrivateDnsZoneResourceId": {
                    "value": "[parameters('blobsPrivateDnsZoneResourceId')]"
                  },
                  "keyVaultUri": {
                    "value": "[parameters('keyVaultUri')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  },
                  "mlzTags": {
                    "value": "[parameters('mlzTags')]"
                  },
                  "serviceToken": {
                    "value": "[parameters('serviceToken')]"
                  },
                  "skuName": {
                    "value": "[parameters('logStorageSkuName')]"
                  },
                  "storageAccountName": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.storageAccount]"
                  },
                  "storageAccountNetworkInterfaceNamePrefix": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.storageAccountNetworkInterface]"
                  },
                  "storageAccountPrivateEndpointNamePrefix": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.storageAccountPrivateEndpoint]"
                  },
                  "storageEncryptionKeyName": {
                    "value": "[parameters('storageEncryptionKeyName')]"
                  },
                  "subnetResourceId": {
                    "value": "[resourceId(parameters('tiers')[copyIndex()].subscriptionId, parameters('resourceGroupNames')[copyIndex()], 'Microsoft.Network/virtualNetworks/subnets', parameters('tiers')[copyIndex()].namingConvention.virtualNetwork, parameters('tiers')[copyIndex()].namingConvention.subnet)]"
                  },
                  "tablesPrivateDnsZoneResourceId": {
                    "value": "[parameters('tablesPrivateDnsZoneResourceId')]"
                  },
                  "tags": {
                    "value": "[parameters('tags')]"
                  },
                  "userAssignedIdentityResourceId": {
                    "value": "[parameters('userAssignedIdentityResourceId')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "12908544435848997555"
                    }
                  },
                  "parameters": {
                    "blobsPrivateDnsZoneResourceId": {
                      "type": "string"
                    },
                    "keyVaultUri": {
                      "type": "string"
                    },
                    "location": {
                      "type": "string"
                    },
                    "mlzTags": {
                      "type": "object"
                    },
                    "serviceToken": {
                      "type": "string"
                    },
                    "skuName": {
                      "type": "string"
                    },
                    "storageAccountName": {
                      "type": "string"
                    },
                    "storageAccountNetworkInterfaceNamePrefix": {
                      "type": "string"
                    },
                    "storageAccountPrivateEndpointNamePrefix": {
                      "type": "string"
                    },
                    "storageEncryptionKeyName": {
                      "type": "string"
                    },
                    "subnetResourceId": {
                      "type": "string"
                    },
                    "tablesPrivateDnsZoneResourceId": {
                      "type": "string"
                    },
                    "tags": {
                      "type": "object"
                    },
                    "userAssignedIdentityResourceId": {
                      "type": "string"
                    }
                  },
                  "variables": {
                    "zones": [
                      "[parameters('blobsPrivateDnsZoneResourceId')]",
                      "[parameters('tablesPrivateDnsZoneResourceId')]"
                    ]
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Storage/storageAccounts",
                      "apiVersion": "2023-01-01",
                      "name": "[parameters('storageAccountName')]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Storage/storageAccounts'), parameters('tags')['Microsoft.Storage/storageAccounts'], createObject()), parameters('mlzTags'))]",
                      "identity": {
                        "type": "UserAssigned",
                        "userAssignedIdentities": {
                          "[format('{0}', parameters('userAssignedIdentityResourceId'))]": {}
                        }
                      },
                      "kind": "StorageV2",
                      "sku": {
                        "name": "[parameters('skuName')]"
                      },
                      "properties": {
                        "accessTier": "Hot",
                        "allowBlobPublicAccess": false,
                        "allowCrossTenantReplication": false,
                        "allowedCopyScope": "PrivateLink",
                        "allowSharedKeyAccess": true,
                        "defaultToOAuthAuthentication": false,
                        "dnsEndpointType": "Standard",
                        "encryption": {
                          "identity": {
                            "userAssignedIdentity": "[parameters('userAssignedIdentityResourceId')]"
                          },
                          "keySource": "Microsoft.KeyVault",
                          "keyvaultproperties": {
                            "keyvaulturi": "[parameters('keyVaultUri')]",
                            "keyname": "[parameters('storageEncryptionKeyName')]"
                          },
                          "requireInfrastructureEncryption": true,
                          "services": {
                            "blob": {
                              "keyType": "Account",
                              "enabled": true
                            },
                            "file": {
                              "keyType": "Account",
                              "enabled": true
                            },
                            "queue": {
                              "keyType": "Account",
                              "enabled": true
                            },
                            "table": {
                              "keyType": "Account",
                              "enabled": true
                            }
                          }
                        },
                        "minimumTlsVersion": "TLS1_2",
                        "networkAcls": {
                          "bypass": "AzureServices",
                          "virtualNetworkRules": [],
                          "ipRules": [],
                          "defaultAction": "Deny"
                        },
                        "publicNetworkAccess": "Disabled",
                        "supportsHttpsTrafficOnly": true
                      }
                    },
                    {
                      "copy": {
                        "name": "privateEndpoints",
                        "count": "[length(variables('zones'))]"
                      },
                      "type": "Microsoft.Network/privateEndpoints",
                      "apiVersion": "2023-04-01",
                      "name": "[replace(parameters('storageAccountPrivateEndpointNamePrefix'), parameters('serviceToken'), split(split(variables('zones')[copyIndex()], '/')[8], '.')[1])]",
                      "location": "[parameters('location')]",
                      "tags": "[union(if(contains(parameters('tags'), 'Microsoft.Network/privateEndpoints'), parameters('tags')['Microsoft.Network/privateEndpoints'], createObject()), parameters('mlzTags'))]",
                      "properties": {
                        "customNetworkInterfaceName": "[replace(parameters('storageAccountNetworkInterfaceNamePrefix'), parameters('serviceToken'), split(split(variables('zones')[copyIndex()], '/')[8], '.')[1])]",
                        "privateLinkServiceConnections": [
                          {
                            "name": "[replace(parameters('storageAccountPrivateEndpointNamePrefix'), parameters('serviceToken'), split(split(variables('zones')[copyIndex()], '/')[8], '.')[1])]",
                            "properties": {
                              "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]",
                              "groupIds": [
                                "[split(split(variables('zones')[copyIndex()], '/')[8], '.')[1]]"
                              ]
                            }
                          }
                        ],
                        "subnet": {
                          "id": "[parameters('subnetResourceId')]"
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
                      ]
                    },
                    {
                      "copy": {
                        "name": "privateDnsZoneGroups",
                        "count": "[length(variables('zones'))]"
                      },
                      "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                      "apiVersion": "2021-08-01",
                      "name": "[format('{0}/{1}', replace(parameters('storageAccountPrivateEndpointNamePrefix'), parameters('serviceToken'), split(split(variables('zones')[copyIndex()], '/')[8], '.')[1]), parameters('storageAccountName'))]",
                      "properties": {
                        "privateDnsZoneConfigs": [
                          {
                            "name": "ipconfig1",
                            "properties": {
                              "privateDnsZoneId": "[variables('zones')[copyIndex()]]"
                            }
                          }
                        ]
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Network/privateEndpoints', replace(parameters('storageAccountPrivateEndpointNamePrefix'), parameters('serviceToken'), split(split(variables('zones')[copyIndex()], '/')[8], '.')[1]))]"
                      ]
                    }
                  ],
                  "outputs": {
                    "id": {
                      "type": "string",
                      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
                    }
                  }
                }
              }
            }
          ],
          "outputs": {
            "storageAccountResourceIds": {
              "type": "array",
              "value": "[union(createArray(resourceId(parameters('tiers')[0].subscriptionId, parameters('resourceGroupNames')[0], 'Microsoft.Storage/storageAccounts', parameters('tiers')[0].namingConvention.storageAccount), resourceId(parameters('tiers')[1].subscriptionId, parameters('resourceGroupNames')[1], 'Microsoft.Storage/storageAccounts', parameters('tiers')[1].namingConvention.storageAccount), resourceId(parameters('tiers')[2].subscriptionId, parameters('resourceGroupNames')[2], 'Microsoft.Storage/storageAccounts', parameters('tiers')[2].namingConvention.storageAccount)), if(parameters('deployIdentity'), createArray(resourceId(parameters('tiers')[3].subscriptionId, parameters('resourceGroupNames')[3], 'Microsoft.Storage/storageAccounts', parameters('tiers')[3].namingConvention.storageAccount)), createArray()))]"
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-remote-access-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-resource-diag-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deployBastion": {
            "value": "[parameters('deployBastion')]"
          },
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "firewallDiagnosticsLogs": {
            "value": "[parameters('firewallDiagnosticsLogs')]"
          },
          "firewallDiagnosticsMetrics": {
            "value": "[parameters('firewallDiagnosticsMetrics')]"
          },
          "keyVaultName": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.keyVaultName.value]"
          },
          "keyVaultDiagnosticLogs": {
            "value": "[parameters('keyVaultDiagnosticsLogs')]"
          },
          "logAnalyticsWorkspaceResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.logAnalyticsWorkspaceResourceId.value]"
          },
          "publicIPAddressDiagnosticsLogs": {
            "value": "[parameters('publicIPAddressDiagnosticsLogs')]"
          },
          "publicIPAddressDiagnosticsMetrics": {
            "value": "[parameters('publicIPAddressDiagnosticsMetrics')]"
          },
          "resourceGroupNames": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value]"
          },
          "serviceToken": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tokens.value.service]"
          },
          "storageAccountResourceIds": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-log-storage-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.storageAccountResourceIds.value]"
          },
          "supportedClouds": {
            "value": "[parameters('supportedClouds')]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "4240331160697686852"
            }
          },
          "parameters": {
            "deployBastion": {
              "type": "bool"
            },
            "deploymentNameSuffix": {
              "type": "string"
            },
            "firewallDiagnosticsLogs": {
              "type": "array"
            },
            "firewallDiagnosticsMetrics": {
              "type": "array"
            },
            "keyVaultDiagnosticLogs": {
              "type": "array"
            },
            "keyVaultName": {
              "type": "string"
            },
            "logAnalyticsWorkspaceResourceId": {
              "type": "string"
            },
            "publicIPAddressDiagnosticsLogs": {
              "type": "array"
            },
            "publicIPAddressDiagnosticsMetrics": {
              "type": "array"
            },
            "resourceGroupNames": {
              "type": "array"
            },
            "serviceToken": {
              "type": "string"
            },
            "storageAccountResourceIds": {
              "type": "array"
            },
            "supportedClouds": {
              "type": "array"
            },
            "tiers": {
              "type": "array"
            }
          },
          "variables": {
            "hub": "[filter(parameters('tiers'), lambda('tier', equals(lambdaVariables('tier').name, 'hub')))[0]]",
            "hubResourceGroupName": "[filter(parameters('resourceGroupNames'), lambda('name', contains(lambdaVariables('name'), 'hub')))[0]]",
            "operations": "[first(filter(parameters('tiers'), lambda('tier', equals(lambdaVariables('tier').name, 'operations'))))]",
            "operationsResourceGroupName": "[filter(parameters('resourceGroupNames'), lambda('name', contains(lambdaVariables('name'), 'operations')))[0]]",
            "publicIPAddresses": "[union(createArray(createObject('name', variables('hub').namingConvention.azureFirewallClientPublicIPAddress, 'diagName', variables('hub').namingConvention.azureFirewallClientPublicIPAddressDiagnosticSetting), createObject('name', variables('hub').namingConvention.azureFirewallManagementPublicIPAddress, 'diagName', variables('hub').namingConvention.azureFirewallManagementPublicIPAddressDiagnosticSetting)), if(parameters('deployBastion'), createArray(createObject('name', variables('hub').namingConvention.bastionHostPublicIPAddress, 'diagName', variables('hub').namingConvention.bastionHostPublicIPAddressDiagnosticSetting)), createArray()))]"
          },
          "resources": [
            {
              "copy": {
                "name": "activityLogDiagnosticSettings",
                "count": "[length(parameters('tiers'))]"
              },
              "condition": "[parameters('tiers')[copyIndex()].deployUniqueResources]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-activity-diags-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "logAnalyticsWorkspaceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "4966252766778833703"
                    }
                  },
                  "parameters": {
                    "logAnalyticsWorkspaceId": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "name": "[format('diag-activity-log-{0}', subscription().subscriptionId)]",
                      "properties": {
                        "workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
                        "logs": [
                          {
                            "category": "Administrative",
                            "enabled": true
                          },
                          {
                            "category": "Security",
                            "enabled": true
                          },
                          {
                            "category": "ServiceHealth",
                            "enabled": true
                          },
                          {
                            "category": "Alert",
                            "enabled": true
                          },
                          {
                            "category": "Recommendation",
                            "enabled": true
                          },
                          {
                            "category": "Policy",
                            "enabled": true
                          },
                          {
                            "category": "Autoscale",
                            "enabled": true
                          },
                          {
                            "category": "ResourceHealth",
                            "enabled": true
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-law-diag-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('operations').subscriptionId]",
              "resourceGroup": "[variables('operationsResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "diagnosticStorageAccountName": {
                    "value": "[variables('operations').namingConvention.storageAccount]"
                  },
                  "logAnalyticsWorkspaceDiagnosticSettingName": {
                    "value": "[variables('operations').namingConvention.logAnalyticsWorkspaceDiagnosticSetting]"
                  },
                  "logAnalyticsWorkspaceName": {
                    "value": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8]]"
                  },
                  "supportedClouds": {
                    "value": "[parameters('supportedClouds')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "8594084510137329954"
                    }
                  },
                  "parameters": {
                    "diagnosticStorageAccountName": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceDiagnosticSettingName": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceName": {
                      "type": "string"
                    },
                    "supportedClouds": {
                      "type": "array"
                    }
                  },
                  "resources": [
                    {
                      "condition": "[contains(parameters('supportedClouds'), environment().name)]",
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.OperationalInsights/workspaces/{0}', parameters('logAnalyticsWorkspaceName'))]",
                      "name": "[parameters('logAnalyticsWorkspaceDiagnosticSettingName')]",
                      "properties": {
                        "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]",
                        "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('diagnosticStorageAccountName'))]",
                        "logs": "[if(equals(environment().name, 'AzureCloud'), createArray(createObject('category', 'Audit', 'enabled', true())), createArray())]",
                        "metrics": [
                          {
                            "category": "AllMetrics",
                            "enabled": true
                          }
                        ]
                      }
                    }
                  ]
                }
              }
            },
            {
              "copy": {
                "name": "networkSecurityGroupDiagnostics",
                "count": "[length(parameters('tiers'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-nsg-diags-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupNames')[copyIndex()]]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "logs": {
                    "value": "[parameters('tiers')[copyIndex()].nsgDiagLogs]"
                  },
                  "logStorageAccountResourceId": {
                    "value": "[parameters('storageAccountResourceIds')[copyIndex()]]"
                  },
                  "metrics": {
                    "value": "[parameters('tiers')[copyIndex()].nsgDiagMetrics]"
                  },
                  "networkSecurityGroupDiagnosticSettingName": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.networkSecurityGroupDiagnosticSetting]"
                  },
                  "networkSecurityGroupName": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.networkSecurityGroup]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "1055200934770590443"
                    }
                  },
                  "parameters": {
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "logs": {
                      "type": "array"
                    },
                    "logStorageAccountResourceId": {
                      "type": "string"
                    },
                    "metrics": {
                      "type": "array"
                    },
                    "networkSecurityGroupDiagnosticSettingName": {
                      "type": "string"
                    },
                    "networkSecurityGroupName": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.Network/networkSecurityGroups/{0}', parameters('networkSecurityGroupName'))]",
                      "name": "[parameters('networkSecurityGroupDiagnosticSettingName')]",
                      "properties": {
                        "storageAccountId": "[parameters('logStorageAccountResourceId')]",
                        "workspaceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
                        "logs": "[parameters('logs')]",
                        "metrics": "[parameters('metrics')]"
                      }
                    }
                  ]
                }
              }
            },
            {
              "copy": {
                "name": "virtualNetworkDiagnostics",
                "count": "[length(parameters('tiers'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-vnet-diags-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupNames')[copyIndex()]]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "logs": {
                    "value": "[parameters('tiers')[copyIndex()].vnetDiagLogs]"
                  },
                  "logStorageAccountResourceId": {
                    "value": "[parameters('storageAccountResourceIds')[copyIndex()]]"
                  },
                  "metrics": {
                    "value": "[parameters('tiers')[copyIndex()].vnetDiagMetrics]"
                  },
                  "virtualNetworkDiagnosticSettingName": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.virtualNetworkDiagnosticSetting]"
                  },
                  "virtualNetworkName": {
                    "value": "[parameters('tiers')[copyIndex()].namingConvention.virtualNetwork]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "11627959113425338284"
                    }
                  },
                  "parameters": {
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "logs": {
                      "type": "array"
                    },
                    "logStorageAccountResourceId": {
                      "type": "string"
                    },
                    "metrics": {
                      "type": "array"
                    },
                    "virtualNetworkDiagnosticSettingName": {
                      "type": "string"
                    },
                    "virtualNetworkName": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.Network/virtualNetworks/{0}', parameters('virtualNetworkName'))]",
                      "name": "[parameters('virtualNetworkDiagnosticSettingName')]",
                      "properties": {
                        "storageAccountId": "[parameters('logStorageAccountResourceId')]",
                        "workspaceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
                        "logs": "[parameters('logs')]",
                        "metrics": "[parameters('metrics')]"
                      }
                    }
                  ]
                }
              }
            },
            {
              "copy": {
                "name": "publicIpAddressDiagnostics",
                "count": "[length(variables('publicIPAddresses'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-pip-diags-{0}-{1}-{2}', split(variables('publicIPAddresses')[copyIndex()].name, '-')[2], split(variables('publicIPAddresses')[copyIndex()].name, '-')[3], parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('hub').subscriptionId]",
              "resourceGroup": "[variables('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "hubStorageAccountResourceId": {
                    "value": "[parameters('storageAccountResourceIds')[0]]"
                  },
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "publicIPAddressDiagnosticSettingName": {
                    "value": "[variables('publicIPAddresses')[copyIndex()].diagName]"
                  },
                  "publicIPAddressDiagnosticsLogs": {
                    "value": "[parameters('publicIPAddressDiagnosticsLogs')]"
                  },
                  "publicIPAddressDiagnosticsMetrics": {
                    "value": "[parameters('publicIPAddressDiagnosticsMetrics')]"
                  },
                  "publicIPAddressName": {
                    "value": "[variables('publicIPAddresses')[copyIndex()].name]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "15331183806622284781"
                    }
                  },
                  "parameters": {
                    "hubStorageAccountResourceId": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "publicIPAddressDiagnosticSettingName": {
                      "type": "string"
                    },
                    "publicIPAddressDiagnosticsLogs": {
                      "type": "array"
                    },
                    "publicIPAddressDiagnosticsMetrics": {
                      "type": "array"
                    },
                    "publicIPAddressName": {
                      "type": "string"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.Network/publicIPAddresses/{0}', parameters('publicIPAddressName'))]",
                      "name": "[parameters('publicIPAddressDiagnosticSettingName')]",
                      "properties": {
                        "storageAccountId": "[parameters('hubStorageAccountResourceId')]",
                        "workspaceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
                        "logs": "[parameters('publicIPAddressDiagnosticsLogs')]",
                        "metrics": "[parameters('publicIPAddressDiagnosticsMetrics')]"
                      }
                    }
                  ]
                }
              }
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-afw-diags-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('hub').subscriptionId]",
              "resourceGroup": "[variables('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "firewallDiagnosticSettingsName": {
                    "value": "[variables('hub').namingConvention.azureFirewallDiagnosticSetting]"
                  },
                  "firewallName": {
                    "value": "[variables('hub').namingConvention.azureFirewall]"
                  },
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "logs": {
                    "value": "[parameters('firewallDiagnosticsLogs')]"
                  },
                  "logStorageAccountResourceId": {
                    "value": "[parameters('storageAccountResourceIds')[0]]"
                  },
                  "metrics": {
                    "value": "[parameters('firewallDiagnosticsMetrics')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "13690794508005406868"
                    }
                  },
                  "parameters": {
                    "firewallDiagnosticSettingsName": {
                      "type": "string"
                    },
                    "firewallName": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "logs": {
                      "type": "array"
                    },
                    "logStorageAccountResourceId": {
                      "type": "string"
                    },
                    "metrics": {
                      "type": "array"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.Network/azureFirewalls/{0}', parameters('firewallName'))]",
                      "name": "[parameters('firewallDiagnosticSettingsName')]",
                      "properties": {
                        "storageAccountId": "[parameters('logStorageAccountResourceId')]",
                        "workspaceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
                        "logs": "[parameters('logs')]",
                        "metrics": "[parameters('metrics')]"
                      }
                    }
                  ],
                  "outputs": {
                    "privateIPAddress": {
                      "type": "string",
                      "value": "[reference(resourceId('Microsoft.Network/azureFirewalls', parameters('firewallName')), '2021-02-01').ipConfigurations[0].properties.privateIPAddress]"
                    }
                  }
                }
              }
            },
            {
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('deploy-kv-diags-{0}', parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[variables('hub').subscriptionId]",
              "resourceGroup": "[variables('hubResourceGroupName')]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "keyVaultDiagnosticSettingName": {
                    "value": "[replace(variables('hub').namingConvention.keyVaultDiagnosticSetting, parameters('serviceToken'), '')]"
                  },
                  "keyVaultName": {
                    "value": "[parameters('keyVaultName')]"
                  },
                  "keyVaultStorageAccountId": {
                    "value": "[parameters('storageAccountResourceIds')[0]]"
                  },
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "logs": {
                    "value": "[parameters('keyVaultDiagnosticLogs')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "505841804747422350"
                    }
                  },
                  "parameters": {
                    "keyVaultDiagnosticSettingName": {
                      "type": "string"
                    },
                    "keyVaultName": {
                      "type": "string"
                    },
                    "keyVaultStorageAccountId": {
                      "type": "string"
                    },
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "logs": {
                      "type": "array"
                    }
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Insights/diagnosticSettings",
                      "apiVersion": "2017-05-01-preview",
                      "scope": "[format('Microsoft.KeyVault/vaults/{0}', parameters('keyVaultName'))]",
                      "name": "[parameters('keyVaultDiagnosticSettingName')]",
                      "properties": {
                        "storageAccountId": "[parameters('keyVaultStorageAccountId')]",
                        "workspaceId": "[parameters('logAnalyticsWorkspaceResourceId')]",
                        "logs": "[parameters('logs')]"
                      }
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-log-storage-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "condition": "[parameters('deployPolicy')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('assign-policies-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "logAnalyticsWorkspaceResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.logAnalyticsWorkspaceResourceId.value]"
          },
          "policy": {
            "value": "[parameters('policy')]"
          },
          "resourceGroupNames": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.names.value]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "14035929219213937434"
            }
          },
          "parameters": {
            "deploymentNameSuffix": {
              "type": "string"
            },
            "location": {
              "type": "string"
            },
            "logAnalyticsWorkspaceResourceId": {
              "type": "string"
            },
            "policy": {
              "type": "string"
            },
            "resourceGroupNames": {
              "type": "array"
            },
            "tiers": {
              "type": "array"
            }
          },
          "resources": [
            {
              "copy": {
                "name": "policyAssignment",
                "count": "[length(parameters('tiers'))]"
              },
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('assign-policy-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "resourceGroup": "[parameters('resourceGroupNames')[copyIndex()]]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "builtInAssignment": {
                    "value": "[parameters('policy')]"
                  },
                  "logAnalyticsWorkspaceResourceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "location": {
                    "value": "[parameters('location')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "6299651141201738622"
                    }
                  },
                  "parameters": {
                    "builtInAssignment": {
                      "type": "string",
                      "defaultValue": "NISTRev4",
                      "allowedValues": [
                        "NISTRev4",
                        "NISTRev5",
                        "IL5",
                        "CMMC"
                      ],
                      "metadata": {
                        "description": "[NISTRev4/NISTRev5/IL5/CMMC] Built-in policy assignments to assign, default is NISTRev4. IL5 is only available for AzureUsGovernment and will switch to NISTRev4 if tried in AzureCloud."
                      }
                    },
                    "logAnalyticsWorkspaceResourceId": {
                      "type": "string"
                    },
                    "deployRemediation": {
                      "type": "bool",
                      "defaultValue": false,
                      "metadata": {
                        "description": "Starts a policy remediation for the VM Agent policies in hub RG. Set to false by default since this is time consuming in deployment."
                      }
                    },
                    "location": {
                      "type": "string",
                      "defaultValue": "[resourceGroup().location]",
                      "metadata": {
                        "description": "The location of this resource"
                      }
                    }
                  },
                  "variables": {
                    "$fxv#0": "    {\n        \"listOfMembersToExcludeFromWindowsVMAdministratorsGroup\": \n        {\n        \"value\": \"admin\"\n        },\n        \"listOfMembersToIncludeInWindowsVMAdministratorsGroup\": \n        {\n        \"value\": \"azureuser\"\n        },\n        \"logAnalyticsWorkspaceIdforVMReporting\": \n        {\n        \"value\": \"<LAWORKSPACE>\"\n        },\n        \"IncludeArcMachines\": \n        {\n            \"value\": \"true\"\n        },\n        \"MinimumTLSVersion-5752e6d6-1206-46d8-8ab1-ecc2f71a8112\": \n        {\n            \"value\": \"1.2\"\n        },\n        \"NotAvailableMachineState-bed48b13-6647-468e-aa2f-1af1d3f4dd40\": \n        {\n            \"value\": \"Compliant\"\n        },\n        \"requiredRetentionDays\": \n        {\n            \"value\": \"365\"\n        },\n        \"resourceGroupName-b6e2945c-0b7b-40f5-9233-7a5323b5cdc6\": \n        {\n            \"value\": \"NetworkWatcherRG\"\n        }\n    }",
                    "$fxv#1": "    {\n        \"IncludeArcMachines\": \n        {\n            \"value\": \"true\"\n        },\n        \"MinimumTLSVersion-5752e6d6-1206-46d8-8ab1-ecc2f71a8112\": \n        {\n            \"value\": \"1.2\"\n        },\n        \"NotAvailableMachineState-bed48b13-6647-468e-aa2f-1af1d3f4dd40\": \n        {\n            \"value\": \"Compliant\"\n        },\n        \"requiredRetentionDays\": \n        {\n            \"value\": \"365\"\n        },\n        \"resourceGroupName-b6e2945c-0b7b-40f5-9233-7a5323b5cdc6\": \n        {\n            \"value\": \"NetworkWatcherRG\"\n        }\n    }",
                    "$fxv#2": "{\n    \"IncludeArcMachines\" : { \n        \"value\" : \"false\"\n        },\n        \"NotAvailableMachineState-bed48b13-6647-468e-aa2f-1af1d3f4dd40\" : { \n        \"value\" : \"Compliant\"\n        },\n        \"MinimumTLSVersionForWindowsServers\" : { \n        \"value\" : \"1.2\"\n        },\n        \"requiredRetentionDays\" : { \n        \"value\" : \"365\"\n        },\n        \"effect-febd0533-8e55-448f-b837-bd0e06f16469\" : { \n        \"value\" : \"audit\"\n        },\n        \"allowedContainerImagesRegex-febd0533-8e55-448f-b837-bd0e06f16469\" : { \n        \"value\" : \"^(.+){0}$\"\n        },\n        \"effect-95edb821-ddaf-4404-9732-666045e056b4\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-440b515e-a580-421e-abeb-b159a61ddcbc\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-233a2a17-77ca-4fb1-9b6b-69223d272a44\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-e345eecc-fa47-480f-9e88-67dcc122b164\" : { \n        \"value\" : \"audit\"\n        },\n        \"cpuLimit-e345eecc-fa47-480f-9e88-67dcc122b164\" : { \n        \"value\" : \"0\"\n        },\n        \"memoryLimit-e345eecc-fa47-480f-9e88-67dcc122b164\" : { \n        \"value\" : \"0\"\n        },\n        \"effect-f06ddb64-5fa3-4b77-b166-acb36f7f6042\" : { \n        \"value\" : \"audit\"\n        },\n        \"runAsUserRule-f06ddb64-5fa3-4b77-b166-acb36f7f6042\" : { \n        \"value\" : \"MustRunAsNonRoot\"\n        },\n        \"runAsGroupRule-f06ddb64-5fa3-4b77-b166-acb36f7f6042\" : { \n        \"value\" : \"RunAsAny\"\n        },\n        \"supplementalGroupsRule-f06ddb64-5fa3-4b77-b166-acb36f7f6042\" : { \n        \"value\" : \"RunAsAny\"\n        },\n        \"fsGroupRule-f06ddb64-5fa3-4b77-b166-acb36f7f6042\" : { \n        \"value\" : \"RunAsAny\"\n        },\n        \"effect-1c6e92c9-99f0-4e55-9cf2-0c234dc48f99\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-47a1ee2f-2a2a-4576-bf2a-e0e36709c2b8\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-df49d893-a74c-421d-bc95-c663042e5b80\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-1a5b4dca-0b6f-4cf5-907c-56316bc1bf3d\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-c26596ff-4d70-4e6a-9a30-c2506bd2f80c\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-511f5417-5d12-434d-ab2e-816901e72a5e\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-82985f06-dc18-4a48-bc1c-b9f4f0098cfe\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-098fc59e-46c7-4d99-9b16-64990e543d75\" : { \n        \"value\" : \"audit\"\n        },\n        \"NetworkWatcherResourceGroupName\" : { \n        \"value\" : \"NetworkWatcherRG\"\n        },\n        \"setting-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9\" : { \n        \"value\" : \"enabled\"\n        },\n        \"aadAuthenticationInServiceFabricMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-71ef260a-8f18-47b7-abcb-62d0673d94dc\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-055aa869-bc98-4af8-bafc-23f1ab6ffe2c\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-564feb30-bf6a-4854-b4bb-0d2d2d1e6c66\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-862e97cf-49fc-4a5c-9de4-40d4e2e7c8eb\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-d9da03a1-f3c3-412a-9709-947156872263\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-617c02be-7f02-4efd-8836-3180d47b6c68\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-0b60c0b2-2dc2-4e1c-b5c9-abbed971de53\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-ec068d99-e9c7-401f-8cef-5bdde4e6ccf1\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-c349d81b-9985-44ae-a8da-ff98d108ede8\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-3657f5a0-770e-44a3-b44e-9431ba1e9735\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-b4ac1030-89c5-4697-8e00-28b5ba6a8811\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-ea0dfaed-95fb-448c-934e-d6e713ce393d\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-4733ea7b-a883-42fe-8cac-97454c2a9e4a\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-f4b53539-8df9-40e4-86c6-6b607703bd4e\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-41425d9f-d1a5-499a-9932-f8ed8453932c\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-fc4d8e41-e223-45ea-9bf5-eada37891d87\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-86efb160-8de7-451d-bc08-5d475b0aadae\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-4ec52d6d-beb7-40c4-9a9e-fe753254690e\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-64d314f6-6062-4780-a861-c23e8951bee5\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1fd32ebd-e4c3-4e13-a54a-d7422d4d95f6\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-fa298e57-9444-42ba-bf04-86e8470e32c7\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-67121cc7-ff39-4ab8-b7e3-95b84dab487d\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1f905d99-2ab7-462c-a6b0-f709acca6c8f\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-ba769a63-b8cc-4b2d-abf6-ac33c7204be8\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-81e74cea-30fd-40d5-802f-d72103c2aaaa\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-0aa61e00-0a01-4a3c-9945-e93cffedf0e6\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-47031206-ce96-41f8-861b-6a915f3de284\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-87ba29ef-1ab3-4d82-b763-87fcd4f531f7\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-51522a96-0869-4791-82f3-981000c2c67f\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-b5ec538c-daa0-4006-8596-35468b9148e8\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-56a5ee18-2ae6-4810-86f7-18e39ce5629b\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-2e94d99a-8a36-4563-bc77-810d8893b671\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1fafeaf6-7927-4059-a50a-8eb2a7a6f2b5\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-99e9ccd8-3db9-4592-b0d1-14b1715a4d8a\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1f68a601-6e6d-4e42-babf-3f643a047ea2\" : { \n        \"value\" : \"audit\"\n        },\n        \"effect-f7d52b2d-e161-4dfa-a82b-55e564167385\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-7d7be79c-23ba-4033-84dd-45e2a5ccdd67\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-ca91455f-eace-4f96-be59-e6e2c35b4816\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-702dd420-7fcc-42c5-afe8-4026edd20fe0\" : { \n        \"value\" : \"Audit\"\n        },\n        \"diagnosticsLogsInRedisCacheMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"secureTransferToStorageAccountMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-d0793b48-0edc-4296-a390-4c75d1bdfd71\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-7d092e0a-7acd-40d2-a975-dca21cae48c4\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-2a1a9cdf-e04d-429a-8416-3bfb72a1b26f\" : { \n        \"value\" : \"Audit\"\n        },\n        \"disableUnrestrictedNetworkToStorageAccountMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-55615ac9-af46-4a59-874e-391cc3dfb490\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1b8ca024-1d5c-4dec-8995-b1a932b41780\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-037eea7a-bd0a-46c5-9a66-03aea78705d3\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-53503636-bcc9-4748-9663-5348217f160f\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-40cec1dd-a100-4920-b15b-3024fe8901ab\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-0725b4dd-7e76-479c-a735-68e7ee23d5ca\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-a049bf77-880b-470f-ba6d-9f21c530cf83\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-ee980b6d-0eca-4501-8d54-f6290fd512c3\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-1d84d5fb-01f6-4d12-ba4f-4a26081d403d\" : { \n        \"value\" : \"Audit\"\n        },\n        \"effect-37e0d2fe-28a5-43d6-a273-67d37d1f5606\" : { \n        \"value\" : \"Audit\"\n        },\n        \"identityDesignateMoreThanOneOwnerMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"diskEncryptionMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"emailNotificationToSubscriptionOwnerHighSeverityAlertsEnabledEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"functionAppDisableRemoteDebuggingMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"sqlDbEncryptionMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"vulnerabilityAssessmentOnManagedInstanceMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensurePHPVersionLatestForAPIAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"aadAuthenticationInSqlServerMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"vmssEndpointProtectionMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"vmssOsVulnerabilitiesMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"adaptiveApplicationControlsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"geoRedundantBackupShouldBeEnabledForAzureDatabaseForPostgreSQLEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"ensureJavaVersionLatestForWebAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityDesignateLessThanOwnersMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"securityContactEmailAddressForSubscriptionEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"webAppRestrictCORSAccessMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityRemoveExternalAccountWithWritePermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityRemoveExternalAccountWithReadPermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityRemoveDeprecatedAccountMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"functionAppEnforceHttpsMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"ensurePythonVersionLatestForWebAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensurePythonVersionLatestForFunctionAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensurePHPVersionLatestForWebAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensurePythonVersionLatestForAPIAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"geoRedundantBackupShouldBeEnabledForAzureDatabaseForMySQLEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"systemUpdatesMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensureJavaVersionLatestForAPIAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensureHTTPVersionLatestForWebAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"apiAppRequireLatestTlsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityEnableMFAForWritePermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensureHTTPVersionLatestForAPIAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensureJavaVersionLatestForFunctionAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"nextGenerationFirewallMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"useRbacRulesMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"webAppEnforceHttpsMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"sqlServerAuditingMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"vnetEnableDDoSProtectionMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityEnableMFAForOwnerPermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"sqlServerAdvancedDataSecurityMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"sqlManagedInstanceAdvancedDataSecurityMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"endpointProtectionMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"jitNetworkAccessMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"apiAppEnforceHttpsMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"geoRedundantStorageShouldBeEnabledForStorageAccountsEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"vmssSystemUpdatesMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"webAppDisableRemoteDebuggingMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"longtermGeoRedundantBackupEnabledAzureSQLDatabasesEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"systemConfigurationsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"ensureHTTPVersionLatestForFunctionAppEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityEnableMFAForReadPermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"containerBenchmarkMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"apiAppDisableRemoteDebuggingMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityRemoveDeprecatedAccountWithOwnerPermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"vulnerabilityAssessmentOnServerMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"webAppRequireLatestTlsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"identityRemoveExternalAccountWithOwnerPermissionsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"functionAppRequireLatestTlsMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"kubernetesServiceVersionUpToDateMonitoringEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"sqlDbVulnerabilityAssesmentMonitoringEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        },\n        \"membersToIncludeInLocalAdministratorsGroup\" : { \n        \"value\" : \"\"\n        },\n        \"membersToExcludeInLocalAdministratorsGroup\" : { \n        \"value\" : \"\"\n        },\n        \"logAnalyticsWorkspaceIDForVMAgents\" : { \n        \"value\" : \"<LAWORKSPACE>\"\n        },\n        \"PHPLatestVersionForAppServices\" : { \n        \"value\" : \"7.4\"\n        },\n        \"JavaLatestVersionForAppServices\" : { \n        \"value\" : \"11\"\n        },\n        \"WindowsPythonLatestVersionForAppServices\" : { \n        \"value\" : \"3.6\"\n        },\n        \"LinuxPythonLatestVersionForAppServices\" : { \n        \"value\" : \"3.9\"\n        },\n        \"ensureDotNetFrameworkLatestForFunctionAppEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"sqlManagedInstanceAdvancedDataSecurityEmailsMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"vulnerabilityAssessmentMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"ensureDotNetFrameworkLatestForWebAppEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"sqlServerAdvancedDataSecurityEmailsMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"microsoftIaaSAntimalwareExtensionShouldBeDeployedOnWindowsServersEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"securityCenterStandardPricingTierShouldBeSelectedEffect\" : { \n        \"value\" : \"Audit\"\n        },\n        \"theLogAnalyticsAgentShouldBeInstalledOnVirtualMachinesEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"ensurePHPVersionLatestForFunctionAppEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"sqlManagedInstanceAdvancedDataSecurityEmailAdminsMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"securityContactPhoneNumberShouldBeProvidedForSubscriptionEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"threatDetectionTypesOnManagedInstanceMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"ensureDotNetFrameworkLatestForAPIAppEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"sqlServerAdvancedDataSecurityEmailAdminsMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"threatDetectionTypesOnServerMonitoringEffect\" : { \n        \"value\" : \"Disabled\"\n        },\n        \"theLogAnalyticsAgentShouldBeInstalledOnVirtualMachineScaleSetsEffect\" : { \n        \"value\" : \"AuditIfNotExists\"\n        }\n}",
                    "$fxv#3": "{\n    \"logAnalyticsWorkspaceId-f47b5582-33ec-4c5c-87c0-b010a6b2e917\" : { \n        \"value\" : \"<LAWORKSPACE>\"\n    },\n    \"effect-09024ccc-0c5f-475e-9457-b7c0d9ed487b\" : { \n        \"value\" : \"AuditIfNotExists\"\n    },\n    \"MembersToExclude-69bf4abd-ca1e-4cf6-8b5a-762d42e61d4f\" :{\n        \"value\": \"\"\n    },\n    \"MembersToInclude-30f71ea1-ac77-4f26-9fc5-2d926bbd4ba7\": {\n        \"value\": \"\"\n    },\n    \"effect-0961003e-5a0a-4549-abde-af6a37f2724d\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-0b15565f-aa9e-48ba-8619-45960f2c314d\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-0e60b895-3786-45da-8377-9c6b4b6ac5f9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-17k78e20-9358-41c9-923c-fb736d382a12\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-1bc1795e-d44a-4d48-9b3b-6fff0fd5f9ba\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"PHPLatestVersion\" : { \n    \"value\" : \"7.3\"\n    },\n    \"effect-22bee202-a82f-4305-9a2a-6d7f44d4dedb\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-26a828e1-e88f-464e-bbb3-c134a282b9de\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-34c877ad-507e-4c82-993e-3452a6e0ad3c\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-3c735d8a-a4ba-4a3a-b7cf-db7754cf57f4\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-404c3081-a854-4457-ae30-26a93ef643f9\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-47a6b606-51aa-4496-8bb7-64b11cf66adc\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-496223c3-ad65-4ecd-878a-bae78737e9ed\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"JavaLatestVersion\" : { \n    \"value\" : \"11\"\n    },\n    \"effect-4f11b553-d42e-4e3a-89be-32ca364cad4c\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-4f4f78b8-e367-4b10-a341-d9a4ad5cf1c7\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-5c607a2e-c700-4744-8254-d77e7c9eb5e4\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-5f76cf89-fbf2-47fd-a3f4-b891fa780b60\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-6b1cbf55-e8b6-442f-ba4c-7246b6381474\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-6d555dd1-86f2-4f1c-8ed7-5abae7c6cbab\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-7008174a-fd10-4ef0-817e-fc820a951d73\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"LinuxPythonLatestVersion\" : { \n    \"value\" : \"3.8\"\n    },\n    \"effect-7238174a-fd10-4ef0-817e-fc820a951d73\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-7261b898-8a84-4db8-9e04-18527132abb3\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-74c3584d-afae-46f7-a20a-6f8adba71a16\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-86b3d65f-7626-441e-b690-81a8b71cff60\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-88999f4c-376a-45c8-bcb3-4058f713cf39\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-8c122334-9d20-4eb8-89ea-ac9a705b74ae\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-8cb6aa8b-9e41-4f4e-aa25-089a7ac2581e\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-9297c21d-2ed6-4474-b48f-163f75654ce3\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-991310cd-e9f3-47bc-b7b6-f57b557d07db\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-9b597639-28e4-48eb-b506-56b05d366257\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-9d0b6ea4-93e2-4578-bf2f-6bb17d22b4bc\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-9daedab3-fb2d-461e-b861-71790eead4f6\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-a4af4a39-4135-47fb-b175-47fbdf85311d\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"setting-a6fb4358-5bf4-4ad7-ba82-2cd2f41ce5e9\" : { \n    \"value\" : \"enabled\"\n    },\n    \"effect-a70ca396-0a34-413a-88e1-b956c1e683be\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-aa633080-8b72-40c4-a2d7-d00c03e80bed\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-abfb4388-5bf4-4ad7-ba82-2cd2f41ceae9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-abfb7388-5bf4-4ad7-ba99-2cd2f41cebb9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-af6cd1bd-1635-48cb-bde7-5b15693900b9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"resourceGroupName-b6e2945c-0b7b-40f5-9233-7a5323b5cdc6\" : { \n    \"value\" : \"NetworkWatcherRG\"\n    },\n    \"effect-b7ddfbdc-1260-477d-91fd-98bd9be789a6\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-c3f317a7-a95c-4547-b7e7-11017ebdf2fe\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-cb510bfd-1cba-4d9f-a230-cb0976f4bb71\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e1e5fd5d-3e4c-4ce1-8661-7d1873ae6b15\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e2c1c086-2d84-4019-bff3-c44ccd95113c\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e3576e28-8b17-4677-84c3-db2990658d64\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e8cbc669-f12d-49eb-93e7-9273119e9933\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e9c8d085-d9cc-4b17-9cdc-059f1f01f19e\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-ebb62a0c-3560-49e1-89ed-27e074e9f8ad\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-efbde977-ba53-4479-b8e9-10b957924fbf\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-f0e6e85b-9b9f-4a4b-b67b-f730d42f1b0b\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-f6de0be7-9a8a-4b8a-b349-43cf02d22f7c\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-f8456c1c-aa66-4dfb-861a-25d127b775c9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-f9d614c5-c173-4d56-95a7-b4437057d193\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-fb893a29-21bb-418c-a157-e99480ec364c\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-feedbf84-6b99-488c-acc2-71c829aa5ffc\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-3b980d31-7904-4bb7-8575-5665739a8052\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-6e2593d9-add6-4083-9c9b-4b7d2188c899\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b607c5de-e7d9-4eee-9e5c-83f1bcee4fa0\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-12430be1-6cc8-4527-a9a8-e3d38f250096\" : { \n    \"value\" : \"Audit\"\n    },\n    \"modeRequirement-12430be1-6cc8-4527-a9a8-e3d38f250096\" : { \n    \"value\" : \"Detection\"\n    },\n    \"effect-425bea59-a659-4cbb-8d31-34499bd030b8\" : { \n    \"value\" : \"Audit\"\n    },\n    \"modeRequirement-425bea59-a659-4cbb-8d31-34499bd030b8\" : { \n    \"value\" : \"Detection\"\n    },\n    \"effect-564feb30-bf6a-4854-b4bb-0d2d2d1e6c66\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-055aa869-bc98-4af8-bafc-23f1ab6ffe2c\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-013e242c-8828-4970-87b3-ab247555486d\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-d38fc420-0735-4ef3-ac11-c806f651a570\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-a1181c5f-672a-477a-979a-7d58aa086233\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-308fbb08-4ab8-4e67-9b29-592e93fb94fa\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-4da35fc9-c9e7-4960-aec9-797fe7d9051d\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-523b5cd1-3e23-492f-a539-13118b6d1e3a\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-7fe3b40f-802b-4cdd-8bd4-fd799c948cc2\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-c25d9a16-bc35-4e15-a7e5-9db606bf9ed4\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b0f33259-77d7-4c9e-aac6-3aabcfae693c\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-037eea7a-bd0a-46c5-9a66-03aea78705d3\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-0725b4dd-7e76-479c-a735-68e7ee23d5ca\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-0820b7b9-23aa-4725-a1ce-ae4558f718e5\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-2c89a2e5-7285-40fe-afe0-ae8654b92fab\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-358c20a6-3f9e-4f0e-97ff-c6ce485e2aac\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-5744710e-cc2f-4ee8-8809-3b11e89f4bc9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-ac4a19c2-fa67-49b4-8ae5-0b2e78c49457\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-c9d007d0-c057-4772-b18c-01e546713bcd\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-d0793b48-0edc-4296-a390-4c75d1bdfd71\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-e372f825-a257-4fb8-9175-797a8a8627d6\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-d158790f-bfb0-486c-8631-2dc6b4e8e6af\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-e802a67a-daf5-4436-9ea6-f6d821dd0c5d\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-a451c1ef-c6ca-483d-87ed-f49761e3ffb5\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-b954148f-4c11-4c38-8221-be76711e194a-MicrosoftSql-servers-firewallRules-delete\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b954148f-4c11-4c38-8221-be76711e194a-MicrosoftNetwork-networkSecurityGroups-delete\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b954148f-4c11-4c38-8221-be76711e194a-MicrosoftClassicNetwork-networkSecurityGroups-delete\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b954148f-4c11-4c38-8221-be76711e194a-MicrosoftNetwork-networkSecurityGroups-securityRules-delete\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b954148f-4c11-4c38-8221-be76711e194a-MicrosoftClassicNetwork-networkSecurityGroups-securityRules-delete\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-ae89ebca-1c92-4898-ac2c-9f63decb045c\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-d26f7642-7545-4e18-9b75-8c9bbdee3a9a\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-1a4e592a-6a6e-44a5-9814-e36264ca96e7\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-7796937f-307b-4598-941c-67d3a05ebfe7\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-c5447c04-a4d7-4ba8-a263-c9ee321a6858\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-41388f1c-2db0-4c25-95b2-35d7f5ccbfa9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-b02aacc0-b073-424e-8298-42b22829ee0a\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-057d6cfe-9c4f-4a6d-bc60-14420ea1f1a9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-0ec47710-77ff-4a3d-9181-6aa50af424d0\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-48af4db5-9b8b-401c-8e74-076be876a430\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-82339799-d096-41ae-8538-b108becf0970\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-1b7aa243-30e4-4c9e-bca8-d0d3022b634a\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-ef2a8f2a-b3d9-49cd-a8a8-9a3aaaf647d9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-bb91dfba-c30d-4263-9add-9c2384e659a6\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-e71308d3-144b-4262-b144-efdc3cc90517\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-2bdd0062-9d75-436e-89df-487dd8e4b3c7\" : { \n    \"value\" : \"Disabled\"\n    },\n    \"effect-4733ea7b-a883-42fe-8cac-97454c2a9e4a\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-67121cc7-ff39-4ab8-b7e3-95b84dab487d\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-6fac406b-40ca-413b-bf8e-0bf964659c25\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-81e74cea-30fd-40d5-802f-d72103c2aaaa\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-c349d81b-9985-44ae-a8da-ff98d108ede8\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-f4b53539-8df9-40e4-86c6-6b607703bd4e\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-ec068d99-e9c7-401f-8cef-5bdde4e6ccf1\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-048248b0-55cd-46da-b1ff-39efd52db260\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-0d134df8-db83-46fb-ad72-fe0c9428c8dd\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-2c89a2e5-7285-40fe-afe0-ae8654b92fb2\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-3657f5a0-770e-44a3-b44e-9431ba1e9735\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-5b9159ae-1701-4a6f-9a7a-aa9c8ddd0580\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-617c02be-7f02-4efd-8836-3180d47b6c68\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-7d7be79c-23ba-4033-84dd-45e2a5ccdd67\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-87ba29ef-1ab3-4d82-b763-87fcd4f531f7\" : { \n    \"value\" : \"audit\"\n    },\n    \"effect-f7d52b2d-e161-4dfa-a82b-55e564167385\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-c43e4a30-77cb-48ab-a4dd-93f175c63b57\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-0b60c0b2-2dc2-4e1c-b5c9-abbed971de53\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-1e66c121-a66a-4b1f-9b83-0fd99bf0fc2d\" : { \n    \"value\" : \"Audit\"\n    },\n    \"effect-1f314764-cb73-4fc9-b863-8eca98ac36e9\" : { \n    \"value\" : \"AuditIfNotExists\"\n    },\n    \"effect-123a3936-f020-408a-ba0c-47873faf1534\" : { \n    \"value\" : \"AuditIfNotExists\"\n    }\n}\n",
                    "modifiedAssignment": "[if(and(equals(toLower(environment().name), toLower('AzureCloud')), equals(toLower(parameters('builtInAssignment')), toLower('IL5'))), 'NISTRev4', parameters('builtInAssignment'))]",
                    "assignmentName": "[format('{0} {1}', variables('modifiedAssignment'), resourceGroup().name)]",
                    "agentVmssAssignmentName": "[format('Deploy VMSS Agents {0}', resourceGroup().name)]",
                    "agentVmAssignmentName": "[format('Deploy VM Agents {0}', resourceGroup().name)]",
                    "contributorRoleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', 'b24988ac-6180-42a0-ab88-20f7382dd24c')]",
                    "lawsReaderRoleDefinitionId": "[resourceId('Microsoft.Authorization/roleDefinitions', '92aaf0da-9dab-42b6-94a3-d43ce8d16293')]"
                  },
                  "resources": [
                    {
                      "type": "Microsoft.Authorization/policyAssignments",
                      "apiVersion": "2020-09-01",
                      "name": "[variables('assignmentName')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "policyDefinitionId": "[createObject('NISTRev4', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f', 'parameters', json(replace(variables('$fxv#0'), '<LAWORKSPACE>', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])))), 'NISTRev5', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/179d1daa-458f-4e47-8086-2a68d0d6c38f', 'parameters', json(variables('$fxv#1'))), 'IL5', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/f9a961fa-3241-4b20-adc4-bbf8ad9d7197', 'parameters', json(replace(variables('$fxv#2'), '<LAWORKSPACE>', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])))), 'CMMC', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/b5629c75-5c77-4422-87b9-2509e680f8de', 'parameters', json(replace(variables('$fxv#3'), '<LAWORKSPACE>', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8]), '2021-06-01').customerId))))[variables('modifiedAssignment')].id]",
                        "parameters": "[createObject('NISTRev4', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/cf25b9c1-bd23-4eb6-bd2c-f4f3ac644a5f', 'parameters', json(replace(variables('$fxv#0'), '<LAWORKSPACE>', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])))), 'NISTRev5', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/179d1daa-458f-4e47-8086-2a68d0d6c38f', 'parameters', json(variables('$fxv#1'))), 'IL5', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/f9a961fa-3241-4b20-adc4-bbf8ad9d7197', 'parameters', json(replace(variables('$fxv#2'), '<LAWORKSPACE>', extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])))), 'CMMC', createObject('id', '/providers/Microsoft.Authorization/policySetDefinitions/b5629c75-5c77-4422-87b9-2509e680f8de', 'parameters', json(replace(variables('$fxv#3'), '<LAWORKSPACE>', reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8]), '2021-06-01').customerId))))[variables('modifiedAssignment')].parameters]"
                      },
                      "identity": {
                        "type": "SystemAssigned"
                      }
                    },
                    {
                      "type": "Microsoft.Authorization/policyAssignments",
                      "apiVersion": "2020-09-01",
                      "name": "[variables('agentVmssAssignmentName')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "policyDefinitionId": "[tenantResourceId('Microsoft.Authorization/policySetDefinitions', '75714362-cae7-409e-9b99-a8e5075b7fad')]",
                        "parameters": {
                          "logAnalytics_1": {
                            "value": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])]"
                          }
                        }
                      },
                      "identity": {
                        "type": "SystemAssigned"
                      }
                    },
                    {
                      "type": "Microsoft.Authorization/policyAssignments",
                      "apiVersion": "2020-09-01",
                      "name": "[variables('agentVmAssignmentName')]",
                      "location": "[parameters('location')]",
                      "properties": {
                        "policyDefinitionId": "[tenantResourceId('Microsoft.Authorization/policySetDefinitions', '55f3eceb-5573-4f18-9695-226972c6d74a')]",
                        "parameters": {
                          "logAnalytics_1": {
                            "value": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])]"
                          }
                        }
                      },
                      "identity": {
                        "type": "SystemAssigned"
                      }
                    },
                    {
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2020-04-01-preview",
                      "name": "[guid(variables('contributorRoleDefinitionId'), variables('assignmentName'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
                        "principalId": "[if(empty(variables('modifiedAssignment')), '', reference(resourceId('Microsoft.Authorization/policyAssignments', variables('assignmentName')), '2020-09-01', 'full').identity.principalId)]",
                        "principalType": "ServicePrincipal"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Authorization/policyAssignments', variables('assignmentName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2020-04-01-preview",
                      "name": "[guid(variables('contributorRoleDefinitionId'), variables('agentVmssAssignmentName'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
                        "principalId": "[reference(resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmssAssignmentName')), '2020-09-01', 'full').identity.principalId]",
                        "principalType": "ServicePrincipal"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmssAssignmentName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Authorization/roleAssignments",
                      "apiVersion": "2020-04-01-preview",
                      "name": "[guid(variables('contributorRoleDefinitionId'), variables('agentVmAssignmentName'))]",
                      "properties": {
                        "roleDefinitionId": "[variables('contributorRoleDefinitionId')]",
                        "principalId": "[reference(resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName')), '2020-09-01', 'full').identity.principalId]",
                        "principalType": "ServicePrincipal"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName'))]"
                      ]
                    },
                    {
                      "condition": "[parameters('deployRemediation')]",
                      "type": "Microsoft.PolicyInsights/remediations",
                      "apiVersion": "2019-07-01",
                      "name": "VM-Agent-Policy-Remediation",
                      "properties": {
                        "policyAssignmentId": "[resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName'))]",
                        "resourceDiscoveryMode": "ReEvaluateCompliance"
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName'))]"
                      ]
                    },
                    {
                      "type": "Microsoft.Resources/deployments",
                      "apiVersion": "2022-09-01",
                      "name": "[format('Assign-Laws-Role-Policy-{0}', resourceGroup().name)]",
                      "subscriptionId": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2]]",
                      "resourceGroup": "[split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]]",
                      "properties": {
                        "expressionEvaluationOptions": {
                          "scope": "inner"
                        },
                        "mode": "Incremental",
                        "parameters": {
                          "targetResourceId": {
                            "value": "[extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[2], split(parameters('logAnalyticsWorkspaceResourceId'), '/')[4]), 'Microsoft.OperationalInsights/workspaces', split(parameters('logAnalyticsWorkspaceResourceId'), '/')[8])]"
                          },
                          "roleDefinitionId": {
                            "value": "[variables('lawsReaderRoleDefinitionId')]"
                          },
                          "principalId": {
                            "value": "[reference(resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName')), '2020-09-01', 'full').identity.principalId]"
                          }
                        },
                        "template": {
                          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                          "contentVersion": "1.0.0.0",
                          "metadata": {
                            "_generator": {
                              "name": "bicep",
                              "version": "0.28.1.47646",
                              "templateHash": "12311612567285718476"
                            }
                          },
                          "parameters": {
                            "targetResourceId": {
                              "type": "string"
                            },
                            "roleDefinitionId": {
                              "type": "string"
                            },
                            "principalId": {
                              "type": "string"
                            },
                            "principalType": {
                              "type": "string",
                              "defaultValue": "ServicePrincipal",
                              "allowedValues": [
                                "ForeignGroup",
                                "Group",
                                "ServicePrincipal",
                                "User"
                              ]
                            },
                            "description": {
                              "type": "string",
                              "defaultValue": ""
                            }
                          },
                          "resources": [
                            {
                              "type": "Microsoft.Authorization/roleAssignments",
                              "apiVersion": "2020-04-01-preview",
                              "name": "[guid(parameters('targetResourceId'), parameters('roleDefinitionId'), parameters('principalId'))]",
                              "properties": {
                                "principalId": "[parameters('principalId')]",
                                "principalType": "[parameters('principalType')]",
                                "roleDefinitionId": "[parameters('roleDefinitionId')]",
                                "description": "[parameters('description')]"
                              }
                            }
                          ]
                        }
                      },
                      "dependsOn": [
                        "[resourceId('Microsoft.Authorization/policyAssignments', variables('agentVmAssignmentName'))]"
                      ]
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-resource-groups-{0}', parameters('deploymentNameSuffix')))]"
      ]
    },
    {
      "condition": "[parameters('deployDefender')]",
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "[format('deploy-defender-{0}', parameters('deploymentNameSuffix'))]",
      "location": "[deployment().location]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "defenderPlans": {
            "value": "[parameters('deployDefenderPlans')]"
          },
          "defenderSkuTier": {
            "value": "[parameters('defenderSkuTier')]"
          },
          "deploymentNameSuffix": {
            "value": "[parameters('deploymentNameSuffix')]"
          },
          "emailSecurityContact": {
            "value": "[parameters('emailSecurityContact')]"
          },
          "logAnalyticsWorkspaceResourceId": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.logAnalyticsWorkspaceResourceId.value]"
          },
          "tiers": {
            "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.28.1.47646",
              "templateHash": "503534251958794405"
            }
          },
          "parameters": {
            "defenderPlans": {
              "type": "array",
              "defaultValue": [
                "VirtualMachines"
              ]
            },
            "defenderSkuTier": {
              "type": "string"
            },
            "deploymentNameSuffix": {
              "type": "string"
            },
            "emailSecurityContact": {
              "type": "string"
            },
            "logAnalyticsWorkspaceResourceId": {
              "type": "string"
            },
            "tiers": {
              "type": "array"
            }
          },
          "resources": [
            {
              "copy": {
                "name": "defenderForCloud",
                "count": "[length(parameters('tiers'))]"
              },
              "condition": "[parameters('tiers')[copyIndex()].deployUniqueResources]",
              "type": "Microsoft.Resources/deployments",
              "apiVersion": "2022-09-01",
              "name": "[format('set-defender-{0}-{1}', parameters('tiers')[copyIndex()].name, parameters('deploymentNameSuffix'))]",
              "subscriptionId": "[parameters('tiers')[copyIndex()].subscriptionId]",
              "location": "[deployment().location]",
              "properties": {
                "expressionEvaluationOptions": {
                  "scope": "inner"
                },
                "mode": "Incremental",
                "parameters": {
                  "logAnalyticsWorkspaceId": {
                    "value": "[parameters('logAnalyticsWorkspaceResourceId')]"
                  },
                  "emailSecurityContact": {
                    "value": "[parameters('emailSecurityContact')]"
                  },
                  "defenderSkuTier": {
                    "value": "[parameters('defenderSkuTier')]"
                  },
                  "defenderPlans": {
                    "value": "[parameters('defenderPlans')]"
                  }
                },
                "template": {
                  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
                  "contentVersion": "1.0.0.0",
                  "metadata": {
                    "_generator": {
                      "name": "bicep",
                      "version": "0.28.1.47646",
                      "templateHash": "17254696147980897511"
                    }
                  },
                  "parameters": {
                    "defenderPlans": {
                      "type": "array",
                      "defaultValue": [
                        "VirtualMachines"
                      ],
                      "metadata": {
                        "description": "Defender Paid protection Plans. Even if a customer selects the free sku, at least 1 paid protection plan must be specified."
                      }
                    },
                    "enableAutoProvisioning": {
                      "type": "bool",
                      "defaultValue": true,
                      "metadata": {
                        "description": "Turn automatic deployment by Defender of the MMA (OMS VM extension) on or off"
                      }
                    },
                    "logAnalyticsWorkspaceId": {
                      "type": "string",
                      "metadata": {
                        "description": "Specify the ID of your custom Log Analytics workspace to collect Defender data."
                      }
                    },
                    "emailSecurityContact": {
                      "type": "string",
                      "metadata": {
                        "description": "Email address of the contact, in the form of john@doe.com"
                      }
                    },
                    "policySetDescription": {
                      "type": "string",
                      "defaultValue": "The Microsoft Cloud Security Benchmark initiative represents the policies and controls implementing security recommendations defined in Microsoft Cloud Security Benchmark v2, see https://aka.ms/azsecbm. This also serves as the Microsoft Defender for Cloud default policy initiative. You can directly assign this initiative, or manage its policies and compliance results within Microsoft Defender.",
                      "metadata": {
                        "description": "Policy Initiative description field"
                      }
                    },
                    "defenderSkuTier": {
                      "type": "string",
                      "defaultValue": "Free",
                      "metadata": {
                        "description": "[Standard/Free] The SKU for Defender. It defaults to \"Free\"."
                      }
                    }
                  },
                  "variables": {
                    "autoProvisioning": "[if(parameters('enableAutoProvisioning'), 'On', 'Off')]",
                    "defenderPaidPlanConfig": {
                      "AzureCloud": {
                        "Api": {
                          "subPlan": "P1"
                        },
                        "appServices": {},
                        "KeyVaults": {
                          "subPlan": "PerKeyVault"
                        },
                        "Arm": {
                          "subPlan": "PerSubscription"
                        },
                        "CloudPosture": {
                          "extensions": [
                            {
                              "name": "SensitiveDataDiscovery",
                              "isEnabled": "True"
                            },
                            {
                              "name": "ContainerRegistriesVulnerabilityAssessments",
                              "isEnabled": "True"
                            },
                            {
                              "name": "AgentlessDiscoveryForKubernetes",
                              "isEnabled": "True"
                            },
                            {
                              "name": "AgentlessVmScanning",
                              "isEnabled": "True"
                            },
                            {
                              "name": "EntraPermissionsManagement",
                              "isEnabled": "True"
                            }
                          ]
                        },
                        "Containers": {
                          "extensions": [
                            {
                              "name": "ContainerRegistriesVulnerabilityAssessments",
                              "isEnabled": "True"
                            },
                            {
                              "name": "AgentlessDiscoveryForKubernetes",
                              "isEnabled": "True"
                            }
                          ]
                        },
                        "CosmosDbs": {},
                        "StorageAccounts": {
                          "subPlan": "DefenderForStorageV2",
                          "extensions": [
                            {
                              "name": "OnUploadMalwareScanning",
                              "isEnabled": "True",
                              "additionalExtensionProperties": {
                                "CapGBPerMonthPerStorageAccount": "5000"
                              }
                            },
                            {
                              "name": "SensitiveDataDiscovery",
                              "isEnabled": "True"
                            }
                          ]
                        },
                        "VirtualMachines": {
                          "subPlan": "P1"
                        },
                        "SqlServerVirtualMachines": {},
                        "SqlServers": {},
                        "OpenSourceRelationalDatabases": {}
                      }
                    }
                  },
                  "resources": [
                    {
                      "copy": {
                        "name": "defenderFreeAllClouds",
                        "count": "[length(parameters('defenderPlans'))]",
                        "mode": "serial",
                        "batchSize": 1
                      },
                      "condition": "[equals(parameters('defenderSkuTier'), 'Free')]",
                      "type": "Microsoft.Security/pricings",
                      "apiVersion": "2023-01-01",
                      "name": "[parameters('defenderPlans')[copyIndex()]]",
                      "properties": {
                        "pricingTier": "[parameters('defenderSkuTier')]"
                      }
                    },
                    {
                      "copy": {
                        "name": "defenderStandardNoSubplanNoExtensions",
                        "count": "[length(parameters('defenderPlans'))]",
                        "mode": "serial",
                        "batchSize": 1
                      },
                      "condition": "[and(equals(parameters('defenderSkuTier'), 'Standard'), not(equals(environment().name, 'AzureCloud')))]",
                      "type": "Microsoft.Security/pricings",
                      "apiVersion": "2023-01-01",
                      "name": "[parameters('defenderPlans')[copyIndex()]]",
                      "properties": {
                        "pricingTier": "[parameters('defenderSkuTier')]"
                      }
                    },
                    {
                      "copy": {
                        "name": "defenderStandardSubplanExtensionsAzureCloud",
                        "count": "[length(parameters('defenderPlans'))]",
                        "mode": "serial",
                        "batchSize": 1
                      },
                      "condition": "[and(equals(parameters('defenderSkuTier'), 'Standard'), equals(environment().name, 'AzureCloud'))]",
                      "type": "Microsoft.Security/pricings",
                      "apiVersion": "2023-01-01",
                      "name": "[parameters('defenderPlans')[copyIndex()]]",
                      "properties": {
                        "pricingTier": "[parameters('defenderSkuTier')]",
                        "subPlan": "[if(contains(variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]], 'subPlan'), variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]].subPlan, json('null'))]",
                        "extensions": "[if(contains(variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]], 'extensions'), variables('defenderPaidPlanConfig')[environment().name][parameters('defenderPlans')[copyIndex()]].extensions, json('null'))]"
                      }
                    },
                    {
                      "type": "Microsoft.Security/autoProvisioningSettings",
                      "apiVersion": "2019-01-01",
                      "name": "default",
                      "properties": {
                        "autoProvision": "[variables('autoProvisioning')]"
                      }
                    },
                    {
                      "type": "Microsoft.Security/workspaceSettings",
                      "apiVersion": "2019-01-01",
                      "name": "default",
                      "properties": {
                        "workspaceId": "[parameters('logAnalyticsWorkspaceId')]",
                        "scope": "[subscription().id]"
                      }
                    },
                    {
                      "condition": "[not(empty(parameters('emailSecurityContact')))]",
                      "type": "Microsoft.Security/securityContacts",
                      "apiVersion": "2020-01-01-preview",
                      "name": "default",
                      "properties": {
                        "notificationsByRole": {
                          "roles": [
                            "AccountAdmin",
                            "Contributor",
                            "Owner",
                            "ServiceAdmin"
                          ],
                          "state": "On"
                        },
                        "alertNotifications": {
                          "state": "On"
                        },
                        "emails": "[parameters('emailSecurityContact')]"
                      }
                    },
                    {
                      "type": "Microsoft.Authorization/policyAssignments",
                      "apiVersion": "2022-06-01",
                      "name": "Microsoft Cloud Security Benchmark",
                      "properties": {
                        "displayName": "Defender Default",
                        "description": "[parameters('policySetDescription')]",
                        "enforcementMode": "DoNotEnforce",
                        "parameters": {},
                        "policyDefinitionId": "[tenantResourceId('Microsoft.Authorization/policySetDefinitions', '1f3afdf9-d0c9-4c3d-847f-89da613e70a8')]"
                      }
                    }
                  ]
                }
              }
            }
          ]
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix')))]",
        "[subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix')))]"
      ]
    }
  ],
  "outputs": {
    "azureFirewallResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.azureFirewallResourceId.value]"
    },
    "diskEncryptionSetResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-cmk-hub-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.diskEncryptionSetResourceId.value]"
    },
    "hubVirtualNetworkResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.hubVirtualNetworkResourceId.value]"
    },
    "identitySubnetResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.identitySubnetResourceId.value]"
    },
    "locationProperties": {
      "type": "object",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.locationProperties.value]"
    },
    "logAnalyticsWorkspaceResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-monitoring-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.logAnalyticsWorkspaceResourceId.value]"
    },
    "sharedServicesSubnetResourceId": {
      "type": "string",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('deploy-networking-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.sharedServicesSubnetResourceId.value]"
    },
    "tiers": {
      "type": "array",
      "value": "[reference(subscriptionResourceId('Microsoft.Resources/deployments', format('get-logic-{0}', parameters('deploymentNameSuffix'))), '2022-09-01').outputs.tiers.value]"
    }
  }
}