managedDisks-galleryAADvm.json

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
    "avd_workbook_name": {
            "defaultValue": "10a032a6-8265-4315-8190-63ee503646ce", // "[newGuid()]",
            "type": "String"
    },
    "AVDStartCounter":{
        "defaultValue": 1,
        "type": "int",
        "metadata": {
            "description": "This is the first AVD count suffix (e.g. '1' means start at AVDHOST-1, '10' means start at AVDHOST-10, etc)."
        }
      },
    "dataCollectionRuleId": {
        "defaultValue":  "[concat('/subscriptions/',parameters('subscriptionId'), '/resourceGroups/', parameters('ResourceGroupNameAVD'), '/providers/Microsoft.Insights/datacollectionrules/', 'microsoft-avd-workbook-dcr')]",
        "type": "string",
        "metadata": {
            "description": "The datacollection rule ID for Azure VM Insights."
        }
    },
    "SPCert": {
            "defaultValue": "SPCert",
            "type": "string",
            "metadata": {
            "description": "Specifies the secretname of the KeyVault item that holds the CA Cert password"
            }
        },

      "credentials_AzureSP": {
        "defaultValue": "",
        "type": "securestring",
        "metadata": {
            "description": "The password used for the Azure SP Certificate passphrase."
        }
      },      
       "DebugDSCDeployment": {
            "defaultValue": false,
            "type": "Bool",
            "metadata": {
                "description": "If true, log files created in Temp directory and imported PFX for Automation remain present."
            }
        },  
         "Tools": {
            "defaultValue": false,
            "type": "Bool",
            "metadata": {
                "description": "If true, tools are left present after cleanup."
            }
        }, 
         "DutchOS": {
            "defaultValue": false,
            "type": "Bool",
            "metadata": {
                "description": "If true, OS and App Language are set to Dutch."
            }
        },  
      "UseDefaultConfig": {
            "defaultValue": false,
            "type": "Bool",
            "metadata": {
                "description": "Use the default Configuration DSC"
            }
        },  
      "KVName": {
        "defaultValue": "",
        "type": "string",
        "metadata": {
            "description": "The name of the Azure Keyvault."
        }
      },      
	  "SubscriptionID": {
	    "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The SubscriptionID where the Storage Account is located."
        }
      },
      "FriendlyVDI": {
	    "defaultValue": "Virtual Desktop",
        "type": "string",
        "metadata": {
          "description": "The SessionDesktop Friendly name."
        }
      },  
      "SPCertificateThumbprint": {
	    "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The Cert Thumbprint for the Service Principal (when using a SP to connect to Azure)."
        }
      }, 
       "SPCertificateName": {
            "defaultValue": "AutomationCert.pfx",
            "type": "string",
            "metadata": {
            "description": "The Cert filename for the Service Principal (when using a SP to connect to Azure)."
            }
        },
      "SPApplicationID": {
	    "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The principalId for the Service Principal (when using a SP to connect to Azure)."
        }
      }, 
      "SPTenantID": {
	    "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The TenantID for the Service Principal (when using a SP to connect to Azure)."
        }
      }, 
      "Subscription": {
	    "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The Subscription for the Service Principal (when using a SP to connect to Azure)."
        }
      }, 
      "OSDiskName": {
	    "defaultValue": "OS-DISK",
        "type": "string",
        "metadata": {
          "description": "The OS diskname for the AVD host."
        }
      },
	  "ResourceGroupNameAVD": {
			"defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The ResourceGroupName where the Storage Account is located."
        }
	  },
	  "StorageAccountName": {
            "type": "String",
            "metadata": {
                "description": "The name for the FSLogix Storage Account."
            },
            "defaultValue": ""
      },
	  "dscsaname": {
            "defaultValue": "",
            "type": "String"
        },      
    "SASToken": {
            "defaultValue": "",
            "type": "securestring"
     },  
	  "AVDHostpoolUsers": {
            "type": "String",
             "metadata": {
                "description": "The security group name for AVD hostpool user access assignment."
            },
            "defaultValue": "SG-AVD-Hostpool-Users"
        }, 	  
	  "AVDHostpoolAdmins": {
            "type": "String",
            "defaultValue": "SG-AVD-Hostpool-Admins",
            "metadata": {
                "description": "The security group name for AVD hostpool VM Administrator access assignment."
            }
        },		
     
        "nestedTemplatesLocation": {
            "defaultValue": "",
            "type": "string",
            "metadata": {
                "description": "The base URI where artifacts required by this template are located."
            }
        },
      "artifactsLocation": {
        "type": "string",
        "metadata": {
          "description": "The base URI where artifacts required by this template are located."
        }
      },
      "availabilityOption": {
        "type": "string",
        "metadata": {
          "description": "The availability option for the VMs."
        },
        "defaultValue": "None",
        "allowedValues": [
          "None",
          "AvailabilitySet",
          "AvailabilityZone"
        ]
      },
      "availabilitySetName": {
        "type": "string",
        "metadata": {
          "description": "The name of availability set to be used when create the VMs."
        },
        "defaultValue": ""
      },
      "availabilityZones": {
        "type": "array",
        "metadata": {
          "description": "The availability zones to equally distribute VMs amongst"
        },
        "defaultValue": []
      },
      "vmGalleryImageOffer": {
        "type": "string",
        "metadata": {
          "description": "(Required when vmImageType = Gallery) Gallery image Offer."
        },
        "defaultValue": ""
      },
      "vmGalleryImagePublisher": {
        "type": "string",
        "metadata": {
          "description": "(Required when vmImageType = Gallery) Gallery image Publisher."
        },
        "defaultValue": ""
      },
      "vmGalleryImageHasPlan": {
        "type": "bool",
        "metadata": {
          "description": "Whether the VM image has a plan or not"
        },
        "defaultValue": false
      },
      "vmGalleryImageSKU": {
        "type": "string",
        "metadata": {
          "description": "(Required when vmImageType = Gallery) Gallery image SKU."
        },
        "defaultValue": ""
      },
      "vmGalleryImageVersion": {
        "type": "string",
        "metadata": {
          "description": "(Required when vmImageType = Gallery) Gallery image version."
        },
        "defaultValue": ""
      },
      "rdshPrefix": {
        "type": "string",
        "metadata": {
          "description": "This prefix will be used in combination with the VM number to create the VM name. This value includes the dash, so if using “rdsh” as the prefix, VMs would be named “rdsh-0”, “rdsh-1”, etc. You should use a unique prefix to reduce name collisions in Active Directory."
        },
        "defaultValue": "[take(toLower(resourceGroup().name),10)]"
      },
      "rdshNumberOfInstances": {
        "type": "int",
        "metadata": {
          "description": "Number of session hosts that will be created and added to the hostpool."
        }
      },
      "rdshVMDiskType": {
        "type": "string",
        "allowedValues": [ "Premium_LRS", "StandardSSD_LRS", "Standard_LRS" ],
        "metadata": {
          "description": "The VM disk type for the VM: HDD or SSD."
        }
      },
      "rdshVmSize": {
        "type": "string",
        "metadata": {
          "description": "The size of the session host VMs."
        },
        "defaultValue": "Standard_A2"
      },
      "rdshVmDiskSizeGB": {
        "type": "int",
        "metadata": {
          "description": "The size of the disk on the vm in GB"
        },
        "defaultValue": 0
      },
      "rdshHibernate": {
        "type": "bool",
        "metadata": {
          "description": "Whether or not the VM is hibernate enabled"
        },
        "defaultValue": false
      },
      "enableAcceleratedNetworking": {
        "type": "bool",
        "metadata": {
          "description": "Enables Accelerated Networking feature, notice that VM size must support it, this is supported in most of general purpose and compute-optimized instances with 2 or more vCPUs, on instances that supports hyperthreading it is required minimum of 4 vCPUs."
        },
        "defaultValue": false
      },
      "vmAdministratorAccountUsername": {
        "type": "string",
        "metadata": {
          "description": "A username to be used as the virtual machine administrator account. The vmAdministratorAccountUsername and  vmAdministratorAccountPassword parameters must both be provided. Otherwise, domain administrator credentials provided by administratorAccountUsername and administratorAccountPassword will be used."
        },
        "defaultValue": ""
      },
      "vmAdministratorAccountPassword": {
        "type": "securestring",
        "metadata": {
          "description": "The password associated with the virtual machine administrator account. The vmAdministratorAccountUsername and  vmAdministratorAccountPassword parameters must both be provided. Otherwise, domain administrator credentials provided by administratorAccountUsername and administratorAccountPassword will be used."
        },
        "defaultValue": ""
      },     
       "UseFSLogix": {
        "type": "bool",
        "metadata": {
          "description": "Use this bool to use FSLogix."
        }
      },
       "DisableFSLogix": {
          "defaultValue": false,
          "type": "bool",
          "metadata": {
          "description": "Set this bool if you want to disable FSLogix."
          }
      },
       "UseProxy": {
        "defaultValue": false,
        "type": "bool",
        "metadata": {
          "description": "Use this bool to use a system-wide Proxy."
        }
      },
      "ProxyValue": {
        "defaultValue": "",
        "type": "string",
        "metadata": {
          "description": "The proxy value, e.g. http://myproxy.com:8080."
        }
      },
      "ProxyBypass": {
            "defaultValue": "",
            "type": "string",
            "metadata": {
            "description": "The proxy bypass values, e.g. *.wvd.microsoft.com;*.azure.net."
            }
        },
      "SPUseCertAuth": {
        "type": "bool",
        "metadata": {
          "description": "Whether the DSC is running using a SP and Certificate from the Keyvault."
        }
      },
      "subnet-id": {
        "type": "string",
        "metadata": {
          "description": "The unique id of the subnet for the nics."
        }
      },        
      "createNetworkSecurityGroup": {
        "type": "bool",
        "metadata": {
          "description": "Whether to create a new network security group or use an existing one"
        },
        "defaultValue": false
      },
      "networkSecurityGroupId": {
        "type": "string",
        "metadata": {
          "description": "The resource id of an existing network security group"
        },
        "defaultValue": ""
      },
      "networkSecurityGroupRules": {
        "type": "array",
        "metadata": {
          "description": "The rules to be given to the new network security group"
        },
        "defaultValue": []
      },
      "networkInterfaceTags": {
        "type": "object",
        "metadata": {
          "description": "The tags to be assigned to the network interfaces"
        },
        "defaultValue": {}
      },  
      "networkSecurityGroupTags": {
        "type": "object",
        "metadata": {
          "description": "The tags to be assigned to the network security groups"
        },
        "defaultValue": {}
      },
      "virtualMachineTags": {
        "type": "object",
        "metadata": {
          "description": "The tags to be assigned to the virtual machines"
        },
        "defaultValue": {}
      },     
      "vmInitialNumber": {
        "type": "int",
        "metadata": {
          "description": "VM name prefix initial number."
        },
        "defaultValue": 0
      },     
      "_guidValue": {
        "type": "string",
        "defaultValue": "[newGuid()]"
      },
      "hostpoolToken": {
        "type": "string",
        "metadata": {
          "description": "The token for adding VMs to the hostpool"
        }
      },
      "hostpoolName": {
        "type": "string",
        "metadata": {
          "description": "The name of the hostpool"
        }
      },
       "appGroupName": {
            "defaultValue": "AVDAppGroup",
            "type": "String",
            "metadata": {
                "description": "The name of the AppGroup to be created."
            }
        },
      "aadJoin": {
        "type": "bool",
        "metadata": {
          "description": "IMPORTANT: You can use this parameter for the test purpose only as AAD Join is public preview. True if AAD Join, false if AD join"
        },
        "defaultValue": true
      },
      "intune": {
        "type": "bool",
        "metadata": {
          "description": "IMPORTANT: Please don't use this parameter as intune enrollment is not supported yet. True if intune enrollment is selected.  False otherwise"
        },
        "defaultValue": true
      },
      "bootDiagnostics": {
        "type": "object",
        "metadata": {
          "description": "Boot diagnostics object taken as body of Diagnostics Profile in VM creation"
        },
        "defaultValue": {
          "enabled": false
        }
      },
      "userAssignedIdentity": {
        "type": "string",
        "metadata": {
          "description": "The name of user assigned identity that will assigned to the VMs. This is an optional parameter."
        },
        "defaultValue": ""
      },
       "userAssignedIdentityID": {
        "type": "string",
        "metadata": {
          "description": "The ID of user assigned identity that will assigned to the VMs. This is an optional parameter."
        },
        "defaultValue": ""
      },     
      "SessionHostConfigurationVersion": {
        "type": "string",
        "metadata": {
          "description": "Session host configuration version of the host pool."
        },
        "defaultValue": ""
      },
      "systemData": {
        "type": "object",
        "metadata": {
          "description": "System data is used for internal purposes, such as support preview features."
        },
        "defaultValue": {}
      },
      "securityType": {
        "type": "string",
        "metadata": {
          "description": "Specifies the SecurityType of the virtual machine. It is set as TrustedLaunch to enable UefiSettings. Default: UefiSettings will not be enabled unless this property is set as TrustedLaunch."
        },
        "defaultValue": "Standard",
        "allowedValues": [
          "Standard",
          "TrustedLaunch",
          "ConfidentialVM"
        ]
      },
      "secureBoot": {
        "type": "bool",
        "metadata": {
          "description": "Specifies whether secure boot should be enabled on the virtual machine."
        },
        "defaultValue": false
      },
      "vTPM": {
        "type": "bool",
        "metadata": {
          "description": "Specifies whether vTPM (Virtual Trusted Platform Module) should be enabled on the virtual machine."
        },
        "defaultValue": false
      },
      "integrityMonitoring": {
        "type": "bool",
        "metadata": {
          "description": "Specifies whether integrity monitoring will be added to the virtual machine."
        },
        "defaultValue": false
      },
      "managedDiskSecurityEncryptionType": {
        "type": "string",
        "defaultValue": "VMGuestStateOnly",
        "allowedValues": [
        "VMGuestStateOnly",
        "DiskWithVMGuestState"
        ],
        "metadata": {
        "description": "Managed disk security encryption type."
        }
      }
    },
    "variables": {
      "emptyArray": [],      
      "storageAccountType": "[parameters('rdshVMDiskType')]",
      "newNsgName": "[concat(parameters('rdshPrefix'), 'nsg-', parameters('_guidValue'))]",
      "newNsgDeploymentName": "[concat('NSG-linkedTemplate-', parameters('_guidValue'))]",
      "nsgId": "[if(parameters('createNetworkSecurityGroup'), resourceId('Microsoft.Network/networkSecurityGroups', variables('newNsgName')), parameters('networkSecurityGroupId'))]",    
      "vmAdministratorUsername": "[parameters('vmAdministratorAccountUsername')]",
      "vmAdministratorPassword": "[parameters('vmAdministratorAccountPassword')]",
      "vmAvailabilitySetResourceId": { "id": "[resourceId('Microsoft.Compute/availabilitySets/', parameters('availabilitySetName'))]" },
      "planInfoEmpty": "[or(empty(parameters('vmGalleryImageSKU')), empty(parameters('vmGalleryImagePublisher')), empty(parameters('vmGalleryImageOffer')))]",
      "marketplacePlan": {
        "name": "[parameters('vmGalleryImageSKU')]",
        "publisher": "[parameters('vmGalleryImagePublisher')]",
        "product": "[parameters('vmGalleryImageOffer')]"
      },
      "vmPlan": "[if(or(variables('planInfoEmpty'), not(parameters('vmGalleryImageHasPlan'))), json('null'), variables('marketplacePlan'))]",
      "vmIdentityType": "[if(parameters('aadJoin'), if(not(empty(parameters('userAssignedIdentity'))), 'SystemAssigned, UserAssigned', 'SystemAssigned'), if(not(empty(parameters('userAssignedIdentity'))), 'UserAssigned', 'None'))]",
      "vmIdentityTypeProperty": {
        "type": "[variables('vmIdentityType')]"
      },
      "vmUserAssignedIdentityProperty": {
        "userAssignedIdentities": {
          "[resourceID('Microsoft.ManagedIdentity/userAssignedIdentities/',parameters('userAssignedIdentity'))]": {}
        }
      },
      "vmIdentity": "[if(not(empty(parameters('userAssignedIdentity'))), union(variables('vmIdentityTypeProperty'), variables('vmUserAssignedIdentityProperty')), variables('vmIdentityTypeProperty'))]",      
      "securityProfile": {
        "uefiSettings": {
          "secureBootEnabled": "[parameters('secureBoot')]",
          "vTpmEnabled": "[parameters('vTPM')]"
        },
        "securityType": "[parameters('securityType')]"
      },
      "managedDiskSecurityProfile":{
        "securityEncryptionType": "[parameters('managedDiskSecurityEncryptionType')]"
      },
      "countOfSelectedAZ":"[length(parameters('availabilityZones'))]" 
    },
    "resources": [
      {
        "apiVersion": "2018-05-01",
        "name": "[variables('newNsgDeploymentName')]",
        "type": "Microsoft.Resources/deployments",
        "properties": {
          "mode": "Incremental",
          "template": {
            "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
            "contentVersion": "1.0.0.0",
            "resources": [
              {
                "condition": "[parameters('createNetworkSecurityGroup')]",
                "type": "Microsoft.Network/networkSecurityGroups",
                "apiVersion": "2019-02-01",
                "name": "[variables('newNsgName')]",
                "location": "[resourceGroup().location]",
                "tags": "[parameters('networkSecurityGroupTags')]",
                "properties": {
                  "securityRules": "[parameters('networkSecurityGroupRules')]"
                }
              }
            ]
          }
        }
      },
      {
        "apiVersion": "2018-11-01",
        "type": "Microsoft.Network/networkInterfaces",
        "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '-nic1')]",
        "location": "[resourceGroup().location]",
        "tags": "[parameters('networkInterfaceTags')]",
        "copy": {
          "name": "rdsh-nic-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "properties": {
          "ipConfigurations": [
            {
              "name": "ipconfig",
              "properties": {
                "privateIPAllocationMethod": "Dynamic",
                "subnet": {
                  "id": "[parameters('subnet-id')]"
                }
              }
            }
          ],
          "enableAcceleratedNetworking": "[parameters('enableAcceleratedNetworking')]",
          "networkSecurityGroup": "[if(empty(parameters('networkSecurityGroupId')), json('null'), json(concat('{\"id\": \"', variables('nsgId'), '\"}')))]"
        },
        "dependsOn": [
          "[variables('newNsgDeploymentName')]"
        ]
      },
      {
        "apiVersion": "2022-08-01",
        "type": "Microsoft.Compute/virtualMachines",
        "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')))]",
        "location": "[resourceGroup().location]",
        "tags": "[parameters('virtualMachineTags')]",
        "plan": "[variables('vmPlan')]",
        "copy": {
          "name": "rdsh-vm-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "dependsOn": [
          "[concat('Microsoft.Network/networkInterfaces/', parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '-nic1')]"
        ],
        "identity": "[variables('vmIdentity')]",
        "properties": {
          "hardwareProfile": {
            "vmSize": "[parameters('rdshVmSize')]"
          },
          "availabilitySet": "[if(equals(parameters('availabilityOption'), 'AvailabilitySet'), variables('vmAvailabilitySetResourceId'), json('null'))]",
          "osProfile": {
            "computerName": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')))]",
            "adminUsername": "[variables('vmAdministratorUsername')]",
            "adminPassword": "[variables('vmAdministratorPassword')]"
          },
          "securityProfile": "[if(or(equals(parameters('securityType'), 'TrustedLaunch'), equals(parameters('securityType'), 'ConfidentialVM')), variables('securityProfile'), json('null'))]",
          "storageProfile": {
            "imageReference": {
              "publisher": "[parameters('vmGalleryImagePublisher')]",
              "offer": "[parameters('vmGalleryImageOffer')]",
              "sku": "[parameters('vmGalleryImageSKU')]",
              "version": "[if(empty(parameters('vmGalleryImageVersion')), 'latest', parameters('vmGalleryImageVersion'))]"
            },
            "osDisk": {
              "createOption": "FromImage",
              "diskSizeGB": "[if(equals(parameters('rdshVmDiskSizeGB'), 0), json('null'), parameters('rdshVmDiskSizeGB'))]", 
              "managedDisk": {
                "storageAccountType": "[variables('storageAccountType')]",
                "securityProfile": "[if(equals(parameters('securityType'), 'ConfidentialVM'), variables('managedDiskSecurityProfile'), json('null'))]"
              },
              "name" : "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '-', parameters('OSDiskName'))]"
            }
          },
          "networkProfile": {
            "networkInterfaces": [
              {
                "id": "[resourceId('Microsoft.Network/networkInterfaces',concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '-nic1' ))]"
              }
            ]
          },
          "diagnosticsProfile": {
            "bootDiagnostics": "[parameters('bootDiagnostics')]"
          },
          "additionalCapabilities": {
            "hibernationEnabled": "[parameters('rdshHibernate')]"
          },
          "licenseType": "Windows_Client"
        },
        "zones": "[if(equals(parameters('availabilityOption'), 'AvailabilityZone'), array(parameters('availabilityZones')[mod(copyIndex('rdsh-vm-loop'),variables('countOfSelectedAZ'))]), variables('emptyArray'))]"
      },
      {
        "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')),'/GuestAttestation')]",
        "type": "Microsoft.Compute/virtualMachines/extensions",
        "apiVersion": "2018-10-01",
        "location": "[resourceGroup().location]",
        "condition": "[parameters('integrityMonitoring')]",
        "copy": {
          "name": "rdsh-guest-attestation-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "properties": {
            "publisher": "Microsoft.Azure.Security.WindowsAttestation",
            "type": "GuestAttestation",
            "typeHandlerVersion": "1.0",
            "autoUpgradeMinorVersion": true,
            "settings": {
                "AttestationConfig": {
                    "MaaSettings": {
                        "maaEndpoint": "",
                        "maaTenantName": "GuestAttestation"
                    },
                    "AscSettings": {
                        "ascReportingEndpoint": "",
                        "ascReportingFrequency": ""
                    },
                    "useCustomToken": "false",
                    "disableAlerts": "false"
                }
            }
        },
        "dependsOn": [ "rdsh-vm-loop" ]
      },
      {       
        "apiVersion": "2021-07-01",
        "type": "Microsoft.Compute/virtualMachines/extensions",
        "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '/', 'AADMicrosoft.PowerShell.DSC')]",
        "location": "[resourceGroup().location]",
        "dependsOn": [ "rdsh-guest-attestation-loop" ],
        "copy": {
          "name": "rdsh-dsc-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "properties": {
          "publisher": "Microsoft.Powershell",
          "type": "DSC",
          "typeHandlerVersion": "2.73",
          "autoUpgradeMinorVersion": true,
          "settings": {
            "modulesUrl": "[parameters('artifactsLocation')]",
            "configurationFunction": "Configuration.ps1\\AddSessionHost",
            "properties": {             
              "UseDefaultConfig" : "[parameters('UseDefaultConfig')]",
              "DebugDSCDeployment" : "[parameters('DebugDSCDeployment')]",
              "Tools" : "[parameters('Tools')]",
              "DutchOS" : "[parameters('DutchOS')]",
              "UseFSLogix" : "[parameters('UseFSLogix')]",
              "DisableFSLogix" : "[parameters('DisableFSLogix')]",
              "UseProxy" : "[parameters('UseProxy')]",
              "ProxyValue" : "[parameters('ProxyValue')]",
              "ProxyBypass" : "[parameters('ProxyBypass')]",
              "nestedTemplatesLocation" : "[parameters('nestedTemplatesLocation')]",
              "dscsaname" : "[parameters('dscsaname')]",
              "SASToken" : "[parameters('SASToken')]",
              "SPUseCertAuth" : "[parameters('SPUseCertAuth')]",
              "userAssignedIdentityID":"[parameters('userAssignedIdentityID')]", 
              "KVName" : "[parameters('KVName')]",
              "SPCertificateName" : "[parameters('SPCertificateName')]",
              "SPCertificateThumbprint" : "[parameters('SPCertificateThumbprint')]",
              "SPApplicationID" : "[parameters('SPApplicationID')]",
              "SPTenantID" : "[parameters('SPTenantID')]",
              "Subscription" : "[parameters('Subscription')]",
              "FriendlyVDI" : "[parameters('FriendlyVDI')]",
              "FirstAVDHost" : "[concat(parameters('rdshPrefix'), parameters('AVDStartCounter'))]",
              "AVDHostpoolUsers" : "[parameters('AVDHostpoolUsers')]",	
              "AVDHostpoolAdmins" : "[parameters('AVDHostpoolAdmins')]",	
              "SubscriptionId"  : "[parameters('SubscriptionID')]",	
              "ResourceGroupNameAVD" : "[parameters('ResourceGroupNameAVD')]",		
              "StorageAccountName" :  "[parameters('StorageAccountName')]",	
              "HostPoolName" : "[parameters('hostpoolName')]", 
              "AppGroupName": "[parameters('appGroupName')]",
              "AzureSPCertCreds": {
                "UserName": "[parameters('SPCert')]",
                "Password": "PrivateSettingsRef:AzureSPCertPassword"
              },
              "localAdminCreds": {
                "UserName": "[parameters('vmAdministratorAccountUsername')]",
                "Password": "PrivateSettingsRef:LocalAdminPassword"
              },
              "registrationInfoToken": "[parameters('hostpoolToken')]",
              "aadJoin": "[parameters('aadJoin')]",
              "UseAgentDownloadEndpoint": true,
              "aadJoinPreview": "[and(contains(parameters('systemData'), 'aadJoinPreview'), parameters('systemData').aadJoinPreview)]",
              "mdmId": "[if(parameters('intune'), '0000000a-0000-0000-c000-000000000000', '')]",
              "sessionHostConfigurationLastUpdateTime": "[parameters('SessionHostConfigurationVersion')]"
            }
			  },
			  "protectedSettings": { 
					"Items": {					 
            "AzureSPCertPassword": "[parameters('credentials_AzureSP')]",
            "LocalAdminPassword": "[parameters('vmAdministratorAccountPassword')]"  }
					}
				}  
        
      }, 
      {
        "condition": "[and(parameters('aadJoin'), if(contains(parameters('systemData'), 'aadJoinPreview'), not(parameters('systemData').aadJoinPreview), bool('true')))]",
        "apiVersion": "2021-07-01",
        "type": "Microsoft.Compute/virtualMachines/extensions",
        "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '/', 'AADLoginForWindows')]",
        "location": "[resourceGroup().location]",
        "dependsOn": [ "rdsh-dsc-loop" ],
        "copy": {
          "name": "rdsh-aad-join-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "properties": {
          "publisher": "Microsoft.Azure.ActiveDirectory",
          "type": "AADLoginForWindows",
          "typeHandlerVersion": "2.0",
          "autoUpgradeMinorVersion": true,
          "settings": "[if(parameters('intune'), createObject('mdmId','0000000a-0000-0000-c000-000000000000'), json('null'))]"
        }
      },      
      {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "apiVersion": "2021-11-01",
      "name": "[concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber')), '/', 'AzureMonitorWindowsAgent')]",
      "location": "[resourceGroup().location]",
      "dependsOn": [       
          "rdsh-dsc-loop",
          "rdsh-aad-join-loop"],
      "copy": {
          "name": "AMA-install-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "properties": {
          "publisher": "Microsoft.Azure.Monitor",
          "type": "AzureMonitorWindowsAgent",
          "typeHandlerVersion": "1.0",
          "settings": {
            "authentication": {
              "managedIdentity": {
                "identifier-name": "mi_res_id",
                "identifier-value": "[parameters('userAssignedIdentityID')]"
              }
            }
          },
          "autoUpgradeMinorVersion": true,
          "enableAutomaticUpgrade": true
        }
      }/*,      
      {            
        "type": "Microsoft.Insights/dataCollectionRuleAssociations",
        "apiVersion": "2021-09-01-preview",
        "name": "AzureMonitorDataCollectionRuleAssociations",
        "copy": {
          "name": "DCR-associate-loop",
          "count": "[parameters('rdshNumberOfInstances')]"
        },
        "scope": "[format('Microsoft.Compute/virtualMachines/{0}', concat(parameters('rdshPrefix'), add(copyindex(parameters('AVDStartCounter')), parameters('vmInitialNumber'))))]",
        "properties": {
            "description": "Association of data collection rule. Deleting this association will break the data collection for this virtual machine.",
            "dataCollectionRuleId": "[parameters('dataCollectionRuleId')]"
        },
        "dependsOn": [
          "AMA-install-loop"]            
      }*/
    ],
    "outputs": {}
  }