infra/main.json

{
  "$schema": "https://schema.management.azure.com/schemas/2018-05-01/subscriptionDeploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.47.16.16243",
      "templateHash": "1747752656385714286"
    }
  },
  "parameters": {
    "resourceNames": {
      "type": "object",
      "metadata": {
        "description": "The exact resource names displayed in the approved setup plan."
      }
    },
    "location": {
      "type": "string"
    },
    "tenantId": {
      "type": "string"
    },
    "applicationId": {
      "type": "string"
    },
    "callerApplicationId": {
      "type": "string"
    },
    "deployerObjectId": {
      "type": "string"
    },
    "providerSettings": {
      "type": "object"
    },
    "packageBlobName": {
      "type": "string"
    },
    "language": {
      "type": "string",
      "allowedValues": [
        "javascript",
        "dotnet",
        "python"
      ]
    },
    "remoteBuild": {
      "type": "bool"
    },
    "servicePlan": {
      "type": "string",
      "defaultValue": "EP1",
      "allowedValues": [
        "FC1",
        "EP1"
      ]
    },
    "tokenVersion": {
      "type": "int",
      "allowedValues": [
        1,
        2
      ]
    }
  },
  "resources": [
    {
      "type": "Microsoft.Resources/resourceGroups",
      "apiVersion": "2024-03-01",
      "name": "[parameters('resourceNames').resourceGroup]",
      "location": "[parameters('location')]",
      "tags": {
        "managedBy": "EPP-Setup",
        "eppApplicationId": "[parameters('applicationId')]",
        "eppLanguage": "[parameters('language')]",
        "eppServicePlan": "[parameters('servicePlan')]"
      }
    },
    {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "epp-endpoint",
      "resourceGroup": "[parameters('resourceNames').resourceGroup]",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "resourceNames": {
            "value": "[parameters('resourceNames')]"
          },
          "location": {
            "value": "[parameters('location')]"
          },
          "tenantId": {
            "value": "[parameters('tenantId')]"
          },
          "applicationId": {
            "value": "[parameters('applicationId')]"
          },
          "callerApplicationId": {
            "value": "[parameters('callerApplicationId')]"
          },
          "deployerObjectId": {
            "value": "[parameters('deployerObjectId')]"
          },
          "tokenVersion": {
            "value": "[parameters('tokenVersion')]"
          },
          "providerSettings": {
            "value": "[parameters('providerSettings')]"
          },
          "packageBlobName": {
            "value": "[parameters('packageBlobName')]"
          },
          "language": {
            "value": "[parameters('language')]"
          },
          "remoteBuild": {
            "value": "[parameters('remoteBuild')]"
          },
          "servicePlan": {
            "value": "[parameters('servicePlan')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.47.16.16243",
              "templateHash": "8824094215485246173"
            }
          },
          "parameters": {
            "resourceNames": {
              "type": "object"
            },
            "location": {
              "type": "string"
            },
            "tenantId": {
              "type": "string"
            },
            "applicationId": {
              "type": "string"
            },
            "callerApplicationId": {
              "type": "string"
            },
            "deployerObjectId": {
              "type": "string"
            },
            "tokenVersion": {
              "type": "int"
            },
            "providerSettings": {
              "type": "object"
            },
            "packageBlobName": {
              "type": "string"
            },
            "language": {
              "type": "string"
            },
            "remoteBuild": {
              "type": "bool"
            },
            "servicePlan": {
              "type": "string",
              "defaultValue": "EP1",
              "allowedValues": [
                "FC1",
                "EP1"
              ]
            }
          },
          "variables": {
            "isFlexConsumption": "[equals(parameters('servicePlan'), 'FC1')]",
            "runtimes": {
              "javascript": {
                "worker": "node",
                "stack": "NODE|22",
                "version": "22"
              },
              "dotnet": {
                "worker": "dotnet-isolated",
                "stack": "DOTNET-ISOLATED|8.0",
                "version": "8.0"
              },
              "python": {
                "worker": "python",
                "stack": "PYTHON|3.11",
                "version": "3.11"
              }
            },
            "runtime": "[variables('runtimes')[parameters('language')]]",
            "tags": {
              "managedBy": "EPP-Setup",
              "eppApplicationId": "[parameters('applicationId')]",
              "eppLanguage": "[parameters('language')]",
              "eppServicePlan": "[parameters('servicePlan')]"
            },
            "blobDataOwnerRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b7e6dc6d-f1e8-4753-8033-0f276bb0955b')]",
            "blobDataContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'ba92f5b4-2d11-453d-a403-e96b0029c9fe')]",
            "queueDataContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '974c5e8b-45b9-4653-ba55-5f855dd0fb88')]",
            "tableDataContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')]",
            "keyVaultSecretsUserRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '4633458b-17de-408a-b874-0445c86b69e6')]",
            "keyVaultSecretsOfficerRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'b86a8fe4-44ce-4948-aee5-eccb2c155cd7')]",
            "keyVaultCertificatesOfficerRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a4417e6f-fecd-4de8-b567-7b0420556985')]",
            "monitoringMetricsPublisherRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '3913510d-42f4-4e42-8a64-420c390055eb')]",
            "issuer": "[if(equals(parameters('tokenVersion'), 2), format('{0}{1}/v2.0', environment().authentication.loginEndpoint, parameters('tenantId')), format('https://sts.windows.net/{0}/', parameters('tenantId')))]"
          },
          "resources": [
            {
              "type": "Microsoft.OperationalInsights/workspaces",
              "apiVersion": "2023-09-01",
              "name": "[parameters('resourceNames').logAnalytics]",
              "location": "[parameters('location')]",
              "tags": "[variables('tags')]",
              "properties": {
                "retentionInDays": 30,
                "features": {
                  "enableLogAccessUsingOnlyResourcePermissions": true
                }
              }
            },
            {
              "type": "Microsoft.ManagedIdentity/userAssignedIdentities",
              "apiVersion": "2023-01-31",
              "name": "[parameters('resourceNames').outboundIdentity]",
              "location": "[parameters('location')]",
              "tags": "[variables('tags')]"
            },
            {
              "type": "Microsoft.Insights/components",
              "apiVersion": "2020-02-02",
              "name": "[parameters('resourceNames').applicationInsights]",
              "location": "[parameters('location')]",
              "kind": "web",
              "tags": "[variables('tags')]",
              "properties": {
                "Application_Type": "web",
                "WorkspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('resourceNames').logAnalytics)]",
                "DisableLocalAuth": true,
                "IngestionMode": "LogAnalytics",
                "RetentionInDays": 30
              },
              "dependsOn": [
                "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('resourceNames').logAnalytics)]"
              ]
            },
            {
              "type": "Microsoft.Storage/storageAccounts",
              "apiVersion": "2023-05-01",
              "name": "[parameters('resourceNames').storageAccount]",
              "location": "[parameters('location')]",
              "tags": "[variables('tags')]",
              "sku": {
                "name": "Standard_LRS"
              },
              "kind": "StorageV2",
              "properties": {
                "accessTier": "Hot",
                "allowBlobPublicAccess": false,
                "allowCrossTenantReplication": false,
                "allowSharedKeyAccess": false,
                "defaultToOAuthAuthentication": true,
                "minimumTlsVersion": "TLS1_2",
                "publicNetworkAccess": "Enabled",
                "supportsHttpsTrafficOnly": true
              }
            },
            {
              "type": "Microsoft.Storage/storageAccounts/blobServices",
              "apiVersion": "2023-05-01",
              "name": "[format('{0}/{1}', parameters('resourceNames').storageAccount, 'default')]",
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]"
              ]
            },
            {
              "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
              "apiVersion": "2023-05-01",
              "name": "[format('{0}/{1}/{2}', parameters('resourceNames').storageAccount, 'default', 'packages')]",
              "properties": {
                "publicAccess": "None"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts/blobServices', parameters('resourceNames').storageAccount, 'default')]"
              ]
            },
            {
              "type": "Microsoft.KeyVault/vaults",
              "apiVersion": "2023-07-01",
              "name": "[parameters('resourceNames').keyVault]",
              "location": "[parameters('location')]",
              "tags": "[variables('tags')]",
              "properties": {
                "tenantId": "[parameters('tenantId')]",
                "enableRbacAuthorization": true,
                "enablePurgeProtection": true,
                "enableSoftDelete": true,
                "softDeleteRetentionInDays": 90,
                "publicNetworkAccess": "Enabled",
                "sku": {
                  "family": "A",
                  "name": "standard"
                }
              }
            },
            {
              "type": "Microsoft.Web/serverfarms",
              "apiVersion": "2024-04-01",
              "name": "[parameters('resourceNames').hostingPlan]",
              "location": "[parameters('location')]",
              "kind": "[if(variables('isFlexConsumption'), 'functionapp', 'linux')]",
              "tags": "[variables('tags')]",
              "sku": "[if(variables('isFlexConsumption'), createObject('name', 'FC1', 'tier', 'FlexConsumption'), createObject('name', 'EP1', 'tier', 'ElasticPremium', 'capacity', 1))]",
              "properties": "[union(createObject('reserved', true()), if(variables('isFlexConsumption'), createObject(), createObject('maximumElasticWorkerCount', 3)))]"
            },
            {
              "type": "Microsoft.Web/sites",
              "apiVersion": "2024-04-01",
              "name": "[parameters('resourceNames').functionApp]",
              "location": "[parameters('location')]",
              "kind": "functionapp,linux",
              "tags": "[variables('tags')]",
              "identity": {
                "type": "SystemAssigned, UserAssigned",
                "userAssignedIdentities": {
                  "[format('{0}', resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('resourceNames').outboundIdentity))]": {}
                }
              },
              "properties": {
                "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('resourceNames').hostingPlan)]",
                "httpsOnly": true,
                "keyVaultReferenceIdentity": "SystemAssigned",
                "publicNetworkAccess": "Disabled",
                "siteConfig": "[union(createObject('http20Enabled', true(), 'minTlsVersion', '1.2'), if(variables('isFlexConsumption'), createObject(), createObject('alwaysOn', true(), 'minimumElasticInstanceCount', 1, 'ftpsState', 'Disabled', 'linuxFxVersion', variables('runtime').stack)))]",
                "functionAppConfig": "[if(variables('isFlexConsumption'), createObject('deployment', createObject('storage', createObject('type', 'blobContainer', 'value', format('{0}{1}', reference(resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount), '2023-05-01').primaryEndpoints.blob, 'packages'), 'authentication', createObject('type', 'SystemAssignedIdentity'))), 'runtime', createObject('name', variables('runtime').worker, 'version', variables('runtime').version), 'scaleAndConcurrency', createObject('instanceMemoryMB', 2048, 'maximumInstanceCount', 40, 'alwaysReady', createArray())), null())]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('resourceNames').outboundIdentity)]",
                "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('resourceNames').storageAccount, 'default', 'packages')]",
                "[resourceId('Microsoft.Web/serverfarms', parameters('resourceNames').hostingPlan)]",
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]"
              ]
            },
            {
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/{1}', parameters('resourceNames').functionApp, 'appsettings')]",
              "properties": "[union(parameters('providerSettings'), createObject('AzureWebJobsStorage__accountName', parameters('resourceNames').storageAccount, 'AzureWebJobsStorage__credential', 'managedidentity', 'APPLICATIONINSIGHTS_CONNECTION_STRING', reference(resourceId('Microsoft.Insights/components', parameters('resourceNames').applicationInsights), '2020-02-02').ConnectionString, 'APPLICATIONINSIGHTS_AUTHENTICATION_STRING', 'Authorization=AAD', 'KEY_VAULT_URL', reference(resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault), '2023-07-01').vaultUri, 'EPP_KEY_VAULT_CACHE_ENABLED', if(variables('isFlexConsumption'), 'false', 'true'), 'EPP_ACCESS_TOKEN_CACHE_ENABLED', if(variables('isFlexConsumption'), 'false', 'true'), 'EPP_OUTBOUND_CLIENT_ID', parameters('applicationId'), 'EPP_OUTBOUND_MI_CLIENT_ID', reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('resourceNames').outboundIdentity), '2023-01-31').clientId, 'EPP_EXPECTED_AUDIENCE', if(equals(parameters('tokenVersion'), 2), parameters('applicationId'), format('api://{0}/{1}', reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01').defaultHostName, parameters('applicationId'))), 'EPP_EXPECTED_ISSUER', variables('issuer'), 'EPP_EXPECTED_CLIENT_ID', parameters('callerApplicationId'), 'EPP_TENANT_ID', parameters('tenantId')), if(variables('isFlexConsumption'), createObject(), union(createObject('FUNCTIONS_EXTENSION_VERSION', '~4', 'FUNCTIONS_WORKER_RUNTIME', variables('runtime').worker), if(parameters('remoteBuild'), createObject('SCM_DO_BUILD_DURING_DEPLOYMENT', 'true', 'ENABLE_ORYX_BUILD', 'true'), createObject('WEBSITE_RUN_FROM_PACKAGE', format('{0}{1}/{2}', reference(resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount), '2023-05-01').primaryEndpoints.blob, 'packages', parameters('packageBlobName')), 'WEBSITE_RUN_FROM_PACKAGE_BLOB_MI_RESOURCE_ID', 'SystemAssigned', 'SCM_DO_BUILD_DURING_DEPLOYMENT', 'false', 'ENABLE_ORYX_BUILD', 'false')))))]",
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
                "[resourceId('Microsoft.Insights/components', parameters('resourceNames').applicationInsights)]",
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('resourceNames').outboundIdentity)]",
                "[resourceId('Microsoft.Storage/storageAccounts/blobServices/containers', parameters('resourceNames').storageAccount, 'default', 'packages')]",
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]",
                "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]"
              ]
            },
            {
              "type": "Microsoft.Web/sites/config",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/{1}', parameters('resourceNames').functionApp, 'authsettingsV2')]",
              "properties": {
                "platform": {
                  "enabled": true
                },
                "globalValidation": {
                  "requireAuthentication": true,
                  "unauthenticatedClientAction": "Return401",
                  "excludedPaths": []
                },
                "httpSettings": {
                  "requireHttps": true
                },
                "identityProviders": {
                  "azureActiveDirectory": {
                    "enabled": true,
                    "registration": {
                      "clientId": "[parameters('applicationId')]",
                      "openIdIssuer": "[variables('issuer')]"
                    },
                    "validation": {
                      "allowedAudiences": [
                        "[if(equals(parameters('tokenVersion'), 2), parameters('applicationId'), format('api://{0}/{1}', reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01').defaultHostName, parameters('applicationId')))]"
                      ],
                      "defaultAuthorizationPolicy": {
                        "allowedApplications": [
                          "[parameters('callerApplicationId')]"
                        ]
                      }
                    }
                  }
                },
                "login": {
                  "tokenStore": {
                    "enabled": false
                  }
                }
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]"
              ]
            },
            {
              "copy": {
                "name": "systemStorageRoles",
                "count": "[length(createArray(variables('blobDataOwnerRoleId'), variables('queueDataContributorRoleId'), variables('tableDataContributorRoleId')))]"
              },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]",
              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount), resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), createArray(variables('blobDataOwnerRoleId'), variables('queueDataContributorRoleId'), variables('tableDataContributorRoleId'))[copyIndex()])]",
              "properties": {
                "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01', 'full').identity.principalId]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[createArray(variables('blobDataOwnerRoleId'), variables('queueDataContributorRoleId'), variables('tableDataContributorRoleId'))[copyIndex()]]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]"
              ]
            },
            {
              "condition": "[not(variables('isFlexConsumption'))]",
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]",
              "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount), parameters('deployerObjectId'), variables('blobDataContributorRoleId'))]",
              "properties": {
                "principalId": "[parameters('deployerObjectId')]",
                "principalType": "User",
                "roleDefinitionId": "[variables('blobDataContributorRoleId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount)]"
              ]
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault), resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), variables('keyVaultSecretsUserRoleId'))]",
              "properties": {
                "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01', 'full').identity.principalId]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[variables('keyVaultSecretsUserRoleId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
                "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]"
              ]
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault), parameters('deployerObjectId'), variables('keyVaultSecretsOfficerRoleId'))]",
              "properties": {
                "principalId": "[parameters('deployerObjectId')]",
                "principalType": "User",
                "roleDefinitionId": "[variables('keyVaultSecretsOfficerRoleId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]"
              ]
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]",
              "name": "[guid(resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault), parameters('deployerObjectId'), variables('keyVaultCertificatesOfficerRoleId'))]",
              "properties": {
                "principalId": "[parameters('deployerObjectId')]",
                "principalType": "User",
                "roleDefinitionId": "[variables('keyVaultCertificatesOfficerRoleId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.KeyVault/vaults', parameters('resourceNames').keyVault)]"
              ]
            },
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "scope": "[resourceId('Microsoft.Insights/components', parameters('resourceNames').applicationInsights)]",
              "name": "[guid(resourceId('Microsoft.Insights/components', parameters('resourceNames').applicationInsights), resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), variables('monitoringMetricsPublisherRoleId'))]",
              "properties": {
                "principalId": "[reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01', 'full').identity.principalId]",
                "principalType": "ServicePrincipal",
                "roleDefinitionId": "[variables('monitoringMetricsPublisherRoleId')]"
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
                "[resourceId('Microsoft.Insights/components', parameters('resourceNames').applicationInsights)]"
              ]
            },
            {
              "type": "Microsoft.Insights/diagnosticSettings",
              "apiVersion": "2021-05-01-preview",
              "scope": "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
              "name": "send-to-log-analytics",
              "properties": {
                "workspaceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('resourceNames').logAnalytics)]",
                "logs": [
                  {
                    "categoryGroup": "allLogs",
                    "enabled": true
                  }
                ],
                "metrics": [
                  {
                    "category": "AllMetrics",
                    "enabled": true
                  }
                ]
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]",
                "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('resourceNames').logAnalytics)]"
              ]
            },
            {
              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/{1}', parameters('resourceNames').functionApp, 'scm')]",
              "properties": {
                "allow": false
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]"
              ]
            },
            {
              "condition": "[not(variables('isFlexConsumption'))]",
              "type": "Microsoft.Web/sites/basicPublishingCredentialsPolicies",
              "apiVersion": "2024-04-01",
              "name": "[format('{0}/{1}', parameters('resourceNames').functionApp, 'ftp')]",
              "properties": {
                "allow": false
              },
              "dependsOn": [
                "[resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp)]"
              ]
            }
          ],
          "outputs": {
            "functionAppName": {
              "type": "string",
              "value": "[parameters('resourceNames').functionApp]"
            },
            "storageAccountName": {
              "type": "string",
              "value": "[parameters('resourceNames').storageAccount]"
            },
            "keyVaultName": {
              "type": "string",
              "value": "[parameters('resourceNames').keyVault]"
            },
            "outboundPrincipalId": {
              "type": "string",
              "value": "[reference(resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', parameters('resourceNames').outboundIdentity), '2023-01-31').principalId]"
            },
            "endpointUrl": {
              "type": "string",
              "value": "[format('https://{0}/api/SendOtp', reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01').defaultHostName)]"
            },
            "identifierUri": {
              "type": "string",
              "value": "[format('api://{0}/{1}', reference(resourceId('Microsoft.Web/sites', parameters('resourceNames').functionApp), '2024-04-01').defaultHostName, parameters('applicationId'))]"
            },
            "packageContainerUrl": {
              "type": "string",
              "value": "[format('{0}{1}/', reference(resourceId('Microsoft.Storage/storageAccounts', parameters('resourceNames').storageAccount), '2023-05-01').primaryEndpoints.blob, 'packages')]"
            }
          }
        }
      },
      "dependsOn": [
        "[subscriptionResourceId('Microsoft.Resources/resourceGroups', parameters('resourceNames').resourceGroup)]"
      ]
    }
  ],
  "outputs": {
    "resourceGroupName": {
      "type": "string",
      "value": "[parameters('resourceNames').resourceGroup]"
    },
    "functionAppName": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.functionAppName.value]"
    },
    "storageAccountName": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.storageAccountName.value]"
    },
    "keyVaultName": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.keyVaultName.value]"
    },
    "outboundPrincipalId": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.outboundPrincipalId.value]"
    },
    "endpointUrl": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.endpointUrl.value]"
    },
    "identifierUri": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.identifierUri.value]"
    },
    "packageContainerUrl": {
      "type": "string",
      "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('resourceNames').resourceGroup), 'Microsoft.Resources/deployments', 'epp-endpoint'), '2025-04-01').outputs.packageContainerUrl.value]"
    }
  }
}