{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "source": "Converted from JV-TF-AzureVirtualDesktopKerberos Terraform project to ARM JSON; Bicep source is main.bicep.",
    "tokenFix": "registrationInfoToken is retrieved with listRegistrationTokens() because registrationInfo.token is not returned by GET/reference for newer AVD hostPool APIs.",
    "secureOutputFix": "The DSC extension retrieves the AVD registration token directly with listRegistrationTokens() inside protectedSettings. The token is not passed through a nested secureString output.",
    "defaultObjectIds": "Default Object IDs added for AVD desktop access group, AVD admins group, AVD service principal, and optional AVD computer group.",
    "stableFlatHostPoolFix": "Host pool is deployed as a normal top-level ARM resource. Nested host pool deployment removed to avoid ResourceNotFound/race issues when application group or DSC extension references the host pool.",
    "intuneDefaultFix": "enrollSessionHostsInIntune default changed to false to prevent Intune/Defender/WDAC/ASR policies from applying before the AVD agent DSC installation completes. Set it to true only after confirming deployment policies do not block MSI execution from the Azure DSC plugin path.",
    "intuneExpressionFix": "enrollSessionHostsInIntune default restored to true for cloud-only deployments. DSC settings.properties is restored to a normal JSON object to avoid ARM parser issues with boolean literals in createObject()."
  },
  "parameters": {
    "abbreviation": {
      "type": "string",
      "defaultValue": "jv",
      "minLength": 2,
      "maxLength": 6,
      "metadata": {
        "description": "Abbreviation used in Azure resource names. Default is jv."
      }
    },
    "adminUsername": {
      "type": "string",
      "metadata": {
        "description": "Local administrator username for the AVD session host VMs."
      }
    },
    "adminPassword": {
      "type": "securestring",
      "metadata": {
        "description": "Local administrator password for the AVD session host VMs. Use a strong password."
      }
    },
    "avdDesktopAccessGroupObjectId": {
      "type": "string",
      "metadata": {
        "description": "Entra ID group Object ID that receives AVD desktop access, Virtual Machine User Login, and Storage File Data SMB Share Contributor permissions."
      },
      "defaultValue": "fa65fdc8-3c24-48a2-bd56-eb2939f965f8"
    },
    "avdAdminsGroupObjectId": {
      "type": "string",
      "metadata": {
        "description": "Entra ID group Object ID that receives Virtual Machine Administrator Login and Storage File Data Privileged Contributor permissions."
      },
      "defaultValue": "d3216b41-c48e-478c-acc4-50d35dff57ab"
    },
    "avdServicePrincipalObjectId": {
      "type": "string",
      "metadata": {
        "description": "Optional Azure Virtual Desktop enterprise application/service principal Object ID. Fill this for Start VM on Connect RBAC. App/client ID is 9cdead84-a844-4324-93f2-b2e6bb768d07, but the object ID is tenant-specific. Leave empty to skip this role assignment."
      },
      "defaultValue": "7ea13f1d-177a-4c0e-98a3-8ef6814a7190"
    },
    "avdComputerGroupObjectId": {
      "type": "string",
      "metadata": {
        "description": "Optional existing Entra ID computer/device group Object ID for AVD session hosts. This template only returns the value for policy targeting; it does not create or populate the group."
      },
      "defaultValue": ""
    },
    "workspaceFriendlyName": {
      "type": "string",
      "metadata": {
        "description": "Friendly name shown for the AVD Workspace."
      },
      "defaultValue": "JV Azure Virtual Desktop Workspace"
    },
    "workspaceDescription": {
      "type": "string",
      "metadata": {
        "description": "Description shown for the AVD Workspace."
      },
      "defaultValue": "Workspace for Azure Virtual Desktop."
    },
    "applicationGroupDescription": {
      "type": "string",
      "metadata": {
        "description": "Description shown for the AVD Desktop Application Group."
      },
      "defaultValue": "Desktop application group for Azure Virtual Desktop."
    },
    "defaultDesktopDisplayName": {
      "type": "string",
      "metadata": {
        "description": "Display name for the default desktop in the Desktop Application Group."
      },
      "defaultValue": "Session Desktop"
    },
    "hostPoolDescription": {
      "type": "string",
      "metadata": {
        "description": "Description shown for the AVD Host Pool."
      },
      "defaultValue": "Pooled Azure Virtual Desktop host pool."
    },
    "hostPoolLoadBalancerType": {
      "type": "string",
      "metadata": {
        "description": "Load balancer type for the pooled host pool."
      },
      "defaultValue": "BreadthFirst",
      "allowedValues": [
        "BreadthFirst",
        "DepthFirst"
      ]
    },
    "hostPoolMaximumSessionsAllowed": {
      "type": "int",
      "metadata": {
        "description": "Maximum concurrent sessions per session host."
      },
      "defaultValue": 8,
      "minValue": 1
    },
    "sessionHostCount": {
      "type": "int",
      "metadata": {
        "description": "Number of AVD session hosts to deploy."
      },
      "defaultValue": 1,
      "minValue": 1,
      "maxValue": 10
    },
    "sessionHostVmSize": {
      "type": "string",
      "metadata": {
        "description": "Azure VM size for the AVD session host VMs."
      },
      "defaultValue": "Standard_E4as_v7"
    },
    "enrollSessionHostsInIntune": {
      "type": "bool",
      "metadata": {
        "description": "Enroll session hosts in Intune during deployment. For cloud-only deployments this should normally stay true. Tenant-side automatic MDM enrollment scope and Intune policies must allow these devices/users."
      },
      "defaultValue": true
    },
    "avdDscConfigurationZipUrl": {
      "type": "string",
      "metadata": {
        "description": "Microsoft AVD DSC configuration package used to register session hosts to the host pool."
      },
      "defaultValue": "https://raw.githubusercontent.com/Azure/RDS-Templates/master/ARM-wvd-templates/DSC/Configuration.zip"
    },
    "tags": {
      "type": "object",
      "metadata": {
        "description": "Add Azure resource tags as a JSON object. Leave empty if no tags are needed."
      },
      "defaultValue": {}
    },
    "registrationTokenExpirationTime": {
      "type": "string",
      "metadata": {
        "description": "AVD registration token expiration time. Default is 27 days from deployment time. Normally do not change this."
      },
      "defaultValue": "[dateTimeAdd(utcNow(), 'P27D')]"
    }
  },
  "variables": {
    "location": "[resourceGroup().location]",
    "abbreviationLower": "[toLower(parameters('abbreviation'))]",
    "abbreviationStorage": "[replace(variables('abbreviationLower'), '-', '')]",
    "vnetAddressSpace": [
      "10.69.0.0/16"
    ],
    "subnetAddressPrefixes": [
      "10.69.0.0/24"
    ],
    "storageIpRules": [],
    "storageNetworkBypass": [
      "AzureServices"
    ],
    "storageReplicationType": "LRS",
    "fileShareSoftDeleteRetentionDays": 7,
    "fslogixShareQuotaGb": 5120,
    "fslogixShareAccessTier": "TransactionOptimized",
    "osDiskSizeGb": 128,
    "imagePublisher": "MicrosoftWindowsDesktop",
    "imageOffer": "windows-11",
    "imageSku": "win11-25h2-avd",
    "imageVersion": "latest",
    "vnetName": "[format('vnet-{0}-vnet01', variables('abbreviationLower'))]",
    "subnetName": "[format('snet-{0}-snet01', variables('abbreviationLower'))]",
    "nsgName": "[format('nsg-{0}-nsg01', variables('abbreviationLower'))]",
    "storageAccountName": "[format('sa{0}{1}', variables('abbreviationStorage'), uniqueString(resourceGroup().id))]",
    "fslogixShareName": "fslogix-profiles",
    "hostPoolName": "[format('vdhp-{0}-avd01', variables('abbreviationLower'))]",
    "applicationGroupName": "[format('vdag-{0}-avd01', variables('abbreviationLower'))]",
    "workspaceName": "[format('vdws-{0}-avd01', variables('abbreviationLower'))]",
    "sessionHostNamePrefix": "[format('vm-{0}-sh', variables('abbreviationLower'))]",
    "entraSsoRdpProperties": "[join(createArray('targetisaadjoined:i:1','enablerdsaadauth:i:1','redirectwebauthn:i:1','audiocapturemode:i:1','audiomode:i:0','camerastoredirect:s:*','devicestoredirect:s:*','drivestoredirect:s:*','redirectclipboard:i:1','redirectcomports:i:1','redirectprinters:i:1','redirectsmartcards:i:1','screen mode id:i:2'), ';')]",
    "intuneMdmApplicationId": "0000000a-0000-0000-c000-000000000000",
    "avdServicePrincipalClientId": "9cdead84-a844-4324-93f2-b2e6bb768d07",
    "desktopVirtualizationPowerOnContributorRoleId": "489581de-a3bd-480d-9518-53dea7416b33",
    "desktopVirtualizationUserRoleId": "1d18fff3-a72a-46b5-b4a9-0b38a3cd7e63",
    "virtualMachineUserLoginRoleId": "fb879df8-f326-4884-b1cf-06f3ad86be52",
    "virtualMachineAdministratorLoginRoleId": "1c0163c0-47e6-4577-8991-ea5c82e286e4",
    "storageFileDataSmbShareContributorRoleId": "0c867c2a-1d8c-454a-a3db-ab2ea1bdc8bb",
    "storageFileDataPrivilegedContributorRoleId": "69566ab7-960f-475b-8e7c-b3118f30c6bd",
    "copy": [
      {
        "name": "sessionHostNames",
        "count": "[parameters('sessionHostCount')]",
        "input": "[format('{0}-{1}', variables('sessionHostNamePrefix'), add(copyIndex('sessionHostNames'), 1))]"
      }
    ],
    "storageIpRuleObjects": []
  },
  "resources": [
    {
      "type": "Microsoft.Network/networkSecurityGroups",
      "apiVersion": "2024-01-01",
      "name": "[variables('nsgName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "securityRules": []
      }
    },
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2024-01-01",
      "name": "[variables('vnetName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": "[variables('vnetAddressSpace')]"
        },
        "subnets": [
          {
            "name": "[variables('subnetName')]",
            "properties": {
              "addressPrefixes": "[variables('subnetAddressPrefixes')]",
              "networkSecurityGroup": {
                "id": "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
              },
              "serviceEndpoints": [
                {
                  "service": "Microsoft.Storage"
                }
              ]
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkSecurityGroups', variables('nsgName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-05-01",
      "name": "[variables('storageAccountName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "sku": {
        "name": "[format('Standard_{0}', variables('storageReplicationType'))]"
      },
      "kind": "StorageV2",
      "properties": {
        "minimumTlsVersion": "TLS1_2",
        "supportsHttpsTrafficOnly": true,
        "allowBlobPublicAccess": false,
        "allowSharedKeyAccess": false,
        "defaultToOAuthAuthentication": true,
        "largeFileSharesState": "Enabled",
        "publicNetworkAccess": "Enabled",
        "isLocalUserEnabled": false,
        "encryption": {
          "keySource": "Microsoft.Storage",
          "requireInfrastructureEncryption": true,
          "services": {
            "blob": {
              "enabled": true,
              "keyType": "Account"
            },
            "file": {
              "enabled": true,
              "keyType": "Account"
            }
          }
        },
        "azureFilesIdentityBasedAuthentication": {
          "directoryServiceOptions": "AADKERB",
          "defaultSharePermission": "StorageFileDataSmbShareContributor"
        },
        "networkAcls": {
          "defaultAction": "Deny",
          "bypass": "[join(variables('storageNetworkBypass'), ',')]",
          "ipRules": "[variables('storageIpRuleObjects')]",
          "virtualNetworkRules": [
            {
              "action": "Allow",
              "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnetName'))]"
            }
          ]
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/fileServices",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/default', variables('storageAccountName'))]",
      "properties": {
        "shareDeleteRetentionPolicy": {
          "enabled": true,
          "days": "[variables('fileShareSoftDeleteRetentionDays')]"
        },
        "protocolSettings": {
          "smb": {
            "versions": "SMB3.1.1",
            "authenticationMethods": "Kerberos",
            "kerberosTicketEncryption": "AES-256",
            "channelEncryption": "AES-256-GCM"
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/default/{1}', variables('storageAccountName'), variables('fslogixShareName'))]",
      "properties": {
        "enabledProtocols": "SMB",
        "shareQuota": "[variables('fslogixShareQuotaGb')]",
        "accessTier": "[variables('fslogixShareAccessTier')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts/fileServices', variables('storageAccountName'), 'default')]"
      ]
    },
    {
      "type": "Microsoft.DesktopVirtualization/hostPools",
      "apiVersion": "2024-04-03",
      "name": "[variables('hostPoolName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "hostPoolType": "Pooled",
        "loadBalancerType": "[parameters('hostPoolLoadBalancerType')]",
        "maxSessionLimit": "[parameters('hostPoolMaximumSessionsAllowed')]",
        "startVMOnConnect": true,
        "validationEnvironment": false,
        "preferredAppGroupType": "Desktop",
        "publicNetworkAccess": "Enabled",
        "managementType": "Standard",
        "friendlyName": "[variables('hostPoolName')]",
        "description": "[parameters('hostPoolDescription')]",
        "customRdpProperty": "[variables('entraSsoRdpProperties')]",
        "registrationInfo": {
          "expirationTime": "[parameters('registrationTokenExpirationTime')]",
          "registrationTokenOperation": "Update"
        }
      }
    },
    {
      "type": "Microsoft.DesktopVirtualization/applicationGroups",
      "apiVersion": "2024-04-03",
      "name": "[variables('applicationGroupName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "applicationGroupType": "Desktop",
        "hostPoolArmPath": "[resourceId('Microsoft.DesktopVirtualization/hostPools', variables('hostPoolName'))]",
        "friendlyName": "[variables('applicationGroupName')]",
        "description": "[parameters('applicationGroupDescription')]",
        "defaultDesktopDisplayName": "[parameters('defaultDesktopDisplayName')]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.DesktopVirtualization/hostPools', variables('hostPoolName'))]"
      ]
    },
    {
      "type": "Microsoft.DesktopVirtualization/workspaces",
      "apiVersion": "2024-04-03",
      "name": "[variables('workspaceName')]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "properties": {
        "friendlyName": "[parameters('workspaceFriendlyName')]",
        "description": "[parameters('workspaceDescription')]",
        "publicNetworkAccess": "Enabled",
        "applicationGroupReferences": [
          "[resourceId('Microsoft.DesktopVirtualization/applicationGroups', variables('applicationGroupName'))]"
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.DesktopVirtualization/applicationGroups', variables('applicationGroupName'))]"
      ]
    },
    {
      "type": "Microsoft.Network/networkInterfaces",
      "apiVersion": "2024-01-01",
      "name": "[format('nic-{0}', variables('sessionHostNames')[copyIndex()])]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "copy": {
        "name": "sessionHostNicCopy",
        "count": "[parameters('sessionHostCount')]"
      },
      "properties": {
        "ipConfigurations": [
          {
            "name": "ipconfig1",
            "properties": {
              "privateIPAllocationMethod": "Dynamic",
              "subnet": {
                "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnetName'), variables('subnetName'))]"
              }
            }
          }
        ]
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/virtualNetworks', variables('vnetName'))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines",
      "apiVersion": "2024-03-01",
      "name": "[variables('sessionHostNames')[copyIndex()]]",
      "location": "[variables('location')]",
      "tags": "[parameters('tags')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "copy": {
        "name": "sessionHostVmCopy",
        "count": "[parameters('sessionHostCount')]"
      },
      "properties": {
        "licenseType": "Windows_Client",
        "hardwareProfile": {
          "vmSize": "[parameters('sessionHostVmSize')]"
        },
        "osProfile": {
          "computerName": "[variables('sessionHostNames')[copyIndex()]]",
          "adminUsername": "[parameters('adminUsername')]",
          "adminPassword": "[parameters('adminPassword')]",
          "windowsConfiguration": {
            "provisionVMAgent": true,
            "enableAutomaticUpdates": true
          }
        },
        "storageProfile": {
          "imageReference": {
            "publisher": "[variables('imagePublisher')]",
            "offer": "[variables('imageOffer')]",
            "sku": "[variables('imageSku')]",
            "version": "[variables('imageVersion')]"
          },
          "osDisk": {
            "name": "[format('osdisk-{0}', variables('sessionHostNames')[copyIndex()])]",
            "createOption": "FromImage",
            "caching": "ReadWrite",
            "diskSizeGB": "[variables('osDiskSizeGb')]",
            "managedDisk": {
              "storageAccountType": "Premium_LRS"
            }
          }
        },
        "networkProfile": {
          "networkInterfaces": [
            {
              "id": "[resourceId('Microsoft.Network/networkInterfaces', format('nic-{0}', variables('sessionHostNames')[copyIndex()]))]",
              "properties": {
                "primary": true,
                "deleteOption": "Delete"
              }
            }
          ]
        },
        "securityProfile": {
          "securityType": "TrustedLaunch",
          "uefiSettings": {
            "secureBootEnabled": true,
            "vTpmEnabled": true
          }
        },
        "diagnosticsProfile": {
          "bootDiagnostics": {
            "enabled": true
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Network/networkInterfaces', format('nic-{0}', variables('sessionHostNames')[copyIndex()]))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "apiVersion": "2024-03-01",
      "name": "[format('{0}/Microsoft.PowerShell.DSC', variables('sessionHostNames')[copyIndex()])]",
      "location": "[variables('location')]",
      "copy": {
        "name": "avdRegistrationExtensionCopy",
        "count": "[parameters('sessionHostCount')]"
      },
      "properties": {
        "publisher": "Microsoft.Powershell",
        "type": "DSC",
        "typeHandlerVersion": "2.83",
        "autoUpgradeMinorVersion": true,
        "settings": {
          "modulesUrl": "[parameters('avdDscConfigurationZipUrl')]",
          "configurationFunction": "Configuration.ps1\\AddSessionHost",
          "properties": {
            "hostPoolName": "[variables('hostPoolName')]",
            "aadJoin": true,
            "mdmId": "[if(parameters('enrollSessionHostsInIntune'), variables('intuneMdmApplicationId'), '')]",
            "UseAgentDownloadEndpoint": true,
            "sessionHostConfigurationLastUpdateTime": ""
          }
        },
        "protectedSettings": {
          "properties": {
            "registrationInfoToken": "[first(listRegistrationTokens(resourceId('Microsoft.DesktopVirtualization/hostPools', variables('hostPoolName')), '2024-04-03').value).token]"
          }
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.Compute/virtualMachines/extensions', variables('sessionHostNames')[copyIndex()], 'AADLoginForWindows')]",
        "[resourceId('Microsoft.DesktopVirtualization/hostPools', variables('hostPoolName'))]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "apiVersion": "2024-03-01",
      "name": "[format('{0}/AADLoginForWindows', variables('sessionHostNames')[copyIndex()])]",
      "location": "[variables('location')]",
      "copy": {
        "name": "aadLoginExtensionCopy",
        "count": "[parameters('sessionHostCount')]"
      },
      "properties": {
        "publisher": "Microsoft.Azure.ActiveDirectory",
        "type": "AADLoginForWindows",
        "typeHandlerVersion": "1.0",
        "autoUpgradeMinorVersion": true,
        "settings": "[if(parameters('enrollSessionHostsInIntune'), createObject('mdmId', variables('intuneMdmApplicationId')), createObject())]"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Compute/virtualMachines', variables('sessionHostNames')[copyIndex()])]"
      ]
    },
    {
      "type": "Microsoft.Compute/virtualMachines/extensions",
      "apiVersion": "2024-03-01",
      "name": "[format('{0}/GuestAttestation', variables('sessionHostNames')[copyIndex()])]",
      "location": "[variables('location')]",
      "copy": {
        "name": "guestAttestationExtensionCopy",
        "count": "[parameters('sessionHostCount')]"
      },
      "properties": {
        "publisher": "Microsoft.Azure.Security.WindowsAttestation",
        "type": "GuestAttestation",
        "typeHandlerVersion": "1.0",
        "autoUpgradeMinorVersion": true
      },
      "dependsOn": [
        "[resourceId('Microsoft.Compute/virtualMachines', variables('sessionHostNames')[copyIndex()])]"
      ]
    },
    {
      "condition": "[not(empty(parameters('avdServicePrincipalObjectId')))]",
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceGroup().id, parameters('avdServicePrincipalObjectId'), variables('desktopVirtualizationPowerOnContributorRoleId'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('desktopVirtualizationPowerOnContributorRoleId'))]",
        "principalId": "[parameters('avdServicePrincipalObjectId')]",
        "principalType": "ServicePrincipal"
      }
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.DesktopVirtualization/applicationGroups', variables('applicationGroupName')), parameters('avdDesktopAccessGroupObjectId'), variables('desktopVirtualizationUserRoleId'))]",
      "scope": "[concat('Microsoft.DesktopVirtualization/applicationGroups/', variables('applicationGroupName'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('desktopVirtualizationUserRoleId'))]",
        "principalId": "[parameters('avdDesktopAccessGroupObjectId')]",
        "principalType": "Group"
      },
      "dependsOn": [
        "[resourceId('Microsoft.DesktopVirtualization/applicationGroups', variables('applicationGroupName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceGroup().id, parameters('avdDesktopAccessGroupObjectId'), variables('virtualMachineUserLoginRoleId'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('virtualMachineUserLoginRoleId'))]",
        "principalId": "[parameters('avdDesktopAccessGroupObjectId')]",
        "principalType": "Group"
      }
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceGroup().id, parameters('avdAdminsGroupObjectId'), variables('virtualMachineAdministratorLoginRoleId'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('virtualMachineAdministratorLoginRoleId'))]",
        "principalId": "[parameters('avdAdminsGroupObjectId')]",
        "principalType": "Group"
      }
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), parameters('avdDesktopAccessGroupObjectId'), variables('storageFileDataSmbShareContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageFileDataSmbShareContributorRoleId'))]",
        "principalId": "[parameters('avdDesktopAccessGroupObjectId')]",
        "principalType": "Group"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName')), parameters('avdAdminsGroupObjectId'), variables('storageFileDataPrivilegedContributorRoleId'))]",
      "scope": "[concat('Microsoft.Storage/storageAccounts/', variables('storageAccountName'))]",
      "properties": {
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', variables('storageFileDataPrivilegedContributorRoleId'))]",
        "principalId": "[parameters('avdAdminsGroupObjectId')]",
        "principalType": "Group"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    }
  ],
  "outputs": {
    "resourceGroupName": {
      "type": "string",
      "value": "[resourceGroup().name]"
    },
    "vnetResourceName": {
      "type": "string",
      "value": "[variables('vnetName')]"
    },
    "subnetResourceName": {
      "type": "string",
      "value": "[variables('subnetName')]"
    },
    "storageAccountResourceName": {
      "type": "string",
      "value": "[variables('storageAccountName')]"
    },
    "fslogixProfilesShareName": {
      "type": "string",
      "value": "[variables('fslogixShareName')]"
    },
    "fslogixProfilesUncPath": {
      "type": "string",
      "value": "[format('\\\\{0}.file.core.windows.net\\{1}', variables('storageAccountName'), variables('fslogixShareName'))]"
    },
    "hostPoolResourceName": {
      "type": "string",
      "value": "[variables('hostPoolName')]"
    },
    "applicationGroupResourceName": {
      "type": "string",
      "value": "[variables('applicationGroupName')]"
    },
    "workspaceResourceName": {
      "type": "string",
      "value": "[variables('workspaceName')]"
    },
    "sessionHostNames": {
      "type": "array",
      "value": "[variables('sessionHostNames')]"
    },
    "entraSsoRdpProperties": {
      "type": "string",
      "value": "[variables('entraSsoRdpProperties')]"
    },
    "avdComputerGroupObjectId": {
      "type": "string",
      "value": "[parameters('avdComputerGroupObjectId')]"
    },
    "avdServicePrincipalClientId": {
      "type": "string",
      "value": "[variables('avdServicePrincipalClientId')]"
    },
    "postDeploymentNote": {
      "type": "string",
      "value": "Deploy this template into the resource group you want to use. Resource names are based on the abbreviation parameter. The storage account includes a deterministic unique suffix because Azure Storage account names must be globally unique."
    }
  }
}