Template Parameters Reference

Authority

azure_template/main.bicep is the exhaustive parameter contract. It evolves frequently, so this page groups the current parameter families rather than duplicating every default. Always inspect the template and the selected profile before deployment.

The required base inputs are environment, location, and sqlAdminPassword. environment currently accepts dev, test, staging, and prod. Resource naming is derived from environment, project prefix/name, subscription, and uniqueSuffix unless explicitly overridden.

Parameter families

Family	Representative parameters
Identity and naming	environment, location, projectPrefix, projectName, uniqueSuffix, resourceGroupName, deploymentInstanceId, tags
Component toggles	Runtime/App Service, Function apps, ingestion, Widget, Admin UI, Handbook App, docs variants, health aggregator, Grafana, diagnostics, SQL, Storage, Key Vault, APIM, AI services, AI Search, Cosmos DB, monitoring
Image inputs	dockerImage, functionAppDockerImage, ingestion/web/Function, Widget, dashboard, Handbook, Grafana, health aggregator, diagnostics image parameters
Compute and data SKU	appServicePlanSku, capacity, sqlDatabaseSku, max size/autopause, ACR, Storage, Search, Cosmos DB, AI service SKUs
Runtime persistence	Mastra storage backend/schema, persistent filesystem, Azure Files shares, workspace blob/local settings, observability storage
Networking	VNet/private/service endpoints, access restrictions, lockdown, address prefixes, trusted IPs, VPN, DNS/private endpoint controls
Authentication/RBAC	Managed identities, Entra/Easy Auth IDs, deployment principal, human Key Vault roles, Azure RBAC toggles, SQL managed identity
APIM and health	APIM deployment/publisher settings, keep-warm schedule/target/key name, diagnostics, health regions/services
AI/model runtime	Foundry regions/tier/count, quota profiles, model/provider keys, multi-region balancing, Content Safety blocklist
Handbook	Search/embedding/generation deployments and policy-review concurrency/batching controls
Monitoring	App Insights, Log Analytics/central workspace, alert thresholds, query timeouts, notification and runbook metadata

Layering

Values are normally assembled through:

1. azure_template/main.bicep defaults and validation;
2. azure_template/environments/*.bicepparam tier defaults;
3. azure_template/profiles/*.json project component selection;
4. .github/config/projects/*.yml and environments/**/*.yml deployment contract resolution;
5. workflow inputs and protected secret/OIDC values.

Use the resolved local deployment plan as evidence. A value shown in a Bicep default does not prove that a project profile enables the component.

Current important defaults

• App Service plan defaults to B2; SQL defaults to Basic; ACR defaults to Basic.
• VNet and service endpoints default on; private endpoints, network lockdown, and app access restrictions default off.
• The main template defaults many component toggles on. Profiles intentionally disable components that a project does not own.
• deployApim currently defaults to true in main.bicep; deployment profiles and orchestration determine whether it is actually deployed/reconciled.
• deploymentSlotNames defaults to an empty array. Slot use must be confirmed from resolved environment/profile data.

Defaults are implementation facts, not recommendations or live state.

SQL password safety

Infrastructure reapply must resolve the existing SQL administrator password from protected configuration rather than silently rotating it. The deployment scripts use SQL_ADMIN_PASSWORD/sql-admin-password; older vaults with only the retired azure-sql-password name require a controlled migration.

Never place a real password in a parameter file, command example, report, or documentation page.

Validation

For profile or parameter changes, run the targeted Bicep/profile and tests/infra/** checks. For promotion design, also render and validate the local promotion/deployment plan required by AGENTS.md. New-environment plan mode and Azure what-if must remain non-mutating.

See Environment configurations, Networking, and RBAC permissions.