Template Parameters Reference

Overview

The main Bicep template (azure_template/main.bicep) accepts parameters that control which resources are deployed and how they are configured. Parameters are organized into logical groups.

Core Parameters

Environment & Location

Parameter	Type	Required	Default	Description
environment	string	Yes	-	Environment name. Allowed: dev, staging, prod
location	string	Yes	-	Azure region for core infrastructure
projectPrefix	string	No	''	Project prefix (e.g., k12, tap). Used in resource names
projectName	string	No	aitools	Base name for all resources
tags	object	No	{}	Additional tags to apply to all resources

Resource Group

Parameter	Type	Required	Default	Description
resourceGroupName	string	No	Auto-generated	Override the resource group name

Default naming formula:

{ENVIRONMENT}-{projectPrefix?}-{projectName}-rg

Module Toggles

Control which components are deployed. All default to true unless noted.

Parameter	Type	Default	Description
deployContainerRegistry	bool	true	Deploy Azure Container Registry
deployAppService	bool	true	Deploy App Service and App Service Plan
deployFunctionApp	bool	true	Deploy Function App (container-based)
deploySqlServer	bool	true	Deploy Azure SQL Server and Database
deployKeyVault	bool	true	Deploy Key Vault
deployAiFoundry	bool	true	Deploy Azure AI model endpoints via Azure AI Services accounts
deployContentSafety	bool	true	Deploy Content Safety
deployFormRecognizer	bool	true	Deploy Form Recognizer (Document Intelligence)
deployApim	bool	false	Deploy API Management (usually shared)
deployAiSearch	bool	false	Deploy Azure AI Search
deployAppInsights	bool	true	Deploy Application Insights
deployStorageAccount	bool	true	Deploy Storage Account

Container Registry Configuration

Parameter	Type	Default	Allowed Values	Description
acrSku	string	Basic	Basic, Standard, Premium	ACR SKU tier

note

Private Endpoints: ACR does not use Private Endpoints in this template. Only Premium SKU supports Private Endpoints, but ACR does not store sensitive business data.

App Service Configuration

Parameter	Type	Default	Allowed Values	Description
appServicePlanSku	string	B1	See SKU table below	App Service Plan SKU
appServicePlanCapacity	int	1	1-30	Number of instances
dockerImage	string	''	-	Docker image for App Service
functionAppDockerImage	string	''	-	Docker image for Function App
deploymentSlotNames	array	[]	Slot names such as ['staging', 'rollback']	Deployment slots to create for App Service, Function App, Ingestion Server, Ingestion Function App, and Widget

note

deploymentSlotNames replaces the older single-slot toggle. In staging and prod, the environment parameter files now provision both staging and rollback slots. dev and test leave this as [].

App Service Plan SKU Options

SKU	Tier	vCPU	RAM	Description
F1	Free	Shared	1 GB	Development only, no scaling
B1	Basic	1	1.75 GB	Dev/test workloads
B2	Basic	2	3.5 GB	Dev/test workloads
B3	Basic	4	7 GB	Dev/test workloads
S1	Standard	1	1.75 GB	Production, auto-scale
S2	Standard	2	3.5 GB	Production, auto-scale
S3	Standard	4	7 GB	Production, auto-scale
P1v2	PremiumV2	1	3.5 GB	High-performance
P2v2	PremiumV2	2	7 GB	High-performance
P3v2	PremiumV2	4	14 GB	High-performance
P0v3	PremiumV3	1	4 GB	Cost-effective Premium
P1v3	PremiumV3	2	8 GB	Latest gen, best value
P2v3	PremiumV3	4	16 GB	Latest gen, best value
P3v3	PremiumV3	8	32 GB	Latest gen, best value

SQL Server Configuration

Parameter	Type	Default	Description
sqlAdminLogin	string	sqladmin	SQL Server administrator login
sqlAdminPassword	secureString	Required	SQL Server administrator password
sqlDatabaseSku	string	Basic	Database SKU tier

The GitHub Actions infra deployment script only generates a SQL admin password when it is creating the SQL Server for the first time. For an existing SQL Server, reapply must resolve the current password from SQL_ADMIN_PASSWORD or sql-admin-password; if none is available, deployment stops rather than silently rotating credentials. Older vaults that only have the retired azure-sql-password secret should copy that value to sql-admin-password once before infrastructure reapply.

SQL Database SKU Options

SKU	Tier	DTUs	Max Size	Description
Basic	Basic	5	2 GB	Dev workloads
S0	Standard	10	250 GB	Light production
S1	Standard	20	250 GB	Standard production
S2	Standard	50	250 GB	Standard production
S3	Standard	100	250 GB	Standard production
S4	Standard	200	250 GB	High transaction
S6	Standard	400	250 GB	High transaction
S7	Standard	800	250 GB	High transaction
S9	Standard	1600	250 GB	High transaction
S12	Standard	3000	250 GB	High transaction
P1	Premium	125	1 TB	Premium performance
P2	Premium	250	1 TB	Premium performance
P4	Premium	500	1 TB	Premium performance
P6	Premium	1000	1 TB	Premium performance
P11	Premium	1750	4 TB	Enterprise scale
P15	Premium	4000	4 TB	Enterprise scale

AI Services Configuration

Parameter	Type	Default	Description
aiFoundryLocation	string	swedencentral	Location for AI Foundry (best model quota). Set to '' to use main location
aiFoundrySku	string	S0	AI Foundry SKU (only S0 available)
contentSafetySku	string	S0	Content Safety SKU: F0 (free) or S0
formRecognizerSku	string	S0	Form Recognizer SKU: F0 (free) or S0

warning

AI Foundry Location: Sweden Central (swedencentral) has the best quota availability for the latest models. Consider using this region for AI services even if the main infrastructure is elsewhere.

Key Vault Configuration

Parameter	Type	Default	Allowed Values	Description
keyVaultSku	string	standard	standard, premium	Key Vault SKU
keyVaultSecretsOfficerObjectIds	array	[]	Azure AD user object IDs to grant Key Vault Secrets Officer on the environment vault

note

RBAC Authorization: Key Vault is configured with RBAC authorization by default (not access policies). The managed identity is assigned the Key Vault Secrets User role.

note

Deployment profiles can keep this human-readable by supplying keyVaultSecretsOfficerLogins; the deploy scripts resolve those logins to object IDs before invoking the template.

Networking Configuration

Parameter	Type	Default	Description
enableVnet	bool	true	Enable Virtual Network deployment (free - recommended)
enablePrivateEndpoints	bool	false	Enable Private Endpoints (~$40/month)
vnetAddressPrefix	string	10.0.0.0/16	VNet address space
enableServiceEndpoints	bool	true	Enable Service Endpoints (free, requires VNet)
allowedIpAddresses	array	[]	IP addresses allowed through firewalls

note

VNets are free! They provide security benefits via Service Endpoints at no cost and are enabled by default in all environments. Only Private Endpoints add cost (~$40/month).

Networking Combinations

VNet	Private Endpoints	Service Endpoints	Monthly Cost	Use Case
true	false	true	$0	Recommended: Free security with Service Endpoints
true	true	true	+$40	Full isolation with Private Endpoints (staging/prod)
false	false	false	$0	Not recommended - public access only

Environment Parameter Files

Pre-configured parameter files are available in azure_template/environments/:

dev.bicepparam

using '../main.bicep'

param environment = 'dev'
param location = 'eastus2'
param projectName = 'aitools'

// Minimal SKUs for cost savings
param acrSku = 'Basic'
param appServicePlanSku = 'B1'
param sqlDatabaseSku = 'Basic'
param contentSafetySku = 'S0'  // Pay-per-use, free tier covers dev usage
param formRecognizerSku = 'S0'  // Pay-per-use, free tier covers dev usage

// VNet enabled (free), no Private Endpoints in dev
param enableVnet = true  // Free - provides Service Endpoints security
param enablePrivateEndpoints = false
param deploymentSlotNames = []

// SQL password (use Key Vault reference in real deployments)
param sqlAdminPassword = '<your-password>'

note

Why S0 instead of F0? The S0 tier for Content Safety and Form Recognizer is pay-per-use with generous free tiers that cover typical development usage. F0 has restrictive rate limits (1 request/second) that can break development workflows, while S0 allows higher throughput and only charges if you exceed the free tier.

staging.bicepparam

using '../main.bicep'

param environment = 'staging'
param location = 'eastus2'
param projectName = 'aitools'

// Production-style networking with staging compute
param acrSku = 'Basic'
param appServicePlanSku = 'P0v3'
param sqlDatabaseSku = 'Basic'
param contentSafetySku = 'S0'
param formRecognizerSku = 'S0'

// Enable VNet, Service Endpoints, and network lockdown
param enableVnet = true
param enablePrivateEndpoints = false
param enableServiceEndpoints = true
param enableNetworkLockdown = true
param enableAppAccessRestrictions = true
param deploymentSlotNames = [
  'staging'
  'rollback'
]

// APIM is deployed separately (Consumption tier)

param sqlAdminPassword = '<your-password>'

prod.bicepparam

using '../main.bicep'

param environment = 'prod'
param location = 'eastus2'
param projectName = 'aitools'

// Production SKUs (cost-optimized)
param acrSku = 'Basic'
param appServicePlanSku = 'P0v3'
param appServicePlanCapacity = 1
param sqlDatabaseSku = 'Basic'
param contentSafetySku = 'S0'
param formRecognizerSku = 'S0'

// Service endpoints + deny-by-default lockdown
param enableVnet = true
param enablePrivateEndpoints = false
param enableServiceEndpoints = true
param enableNetworkLockdown = true
param enableAppAccessRestrictions = true
param deploymentSlotNames = [
  'staging'
  'rollback'
]

// APIM is deployed separately (Consumption tier)

param sqlAdminPassword = '<your-password>'

Deployment Commands

Deploy to Dev

az deployment sub create \
  --location eastus2 \
  --template-file azure_template/main.bicep \
  --parameters azure_template/environments/dev.bicepparam

Deploy to Staging

az deployment sub create \
  --location eastus2 \
  --template-file azure_template/main.bicep \
  --parameters azure_template/environments/staging.bicepparam

Deploy to Prod

az deployment sub create \
  --location eastus2 \
  --template-file azure_template/main.bicep \
  --parameters azure_template/environments/prod.bicepparam

What-If (Preview Changes)

az deployment sub what-if \
  --location eastus2 \
  --template-file azure_template/main.bicep \
  --parameters azure_template/environments/dev.bicepparam

Output Values

The template outputs key values for integration:

Output	Description
resourceGroupName	Name of the created resource group
resourceGroupId	Resource ID of the resource group
identityId	User-Assigned Managed Identity resource ID
identityPrincipalId	Principal ID for RBAC assignments
identityClientId	Client ID for SDK authentication
containerRegistryName	ACR name
containerRegistryLoginServer	ACR login server URL
storageAccountName	Storage Account name
sqlServerFqdn	SQL Server fully qualified domain name
sqlDatabaseName	SQL Database name
aiFoundryEndpoint	AI Foundry endpoint URL
contentSafetyEndpoint	Content Safety endpoint URL
formRecognizerEndpoint	Form Recognizer endpoint URL
appServiceHostname	App Service default hostname
functionAppHostname	Function App default hostname
keyVaultUri	Key Vault URI