{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.31.34.60546",
      "templateHash": "simplified-template"
    }
  },
  "parameters": {
    "location": {
      "type": "string",
      "defaultValue": "swedencentral",
      "allowedValues": [
        "swedencentral",
        "francecentral",
        "germanywestcentral"
      ],
      "metadata": {
        "description": "Azure location where resources should be deployed. Restricted to regions verified to support both the gpt-5.4 and mistral-document-ai-2512 model deployments."
      }
    },
    "deployModelDeployments": {
      "type": "bool",
      "defaultValue": false,
      "metadata": {
        "description": "Whether to create AI model deployments inside the AI Foundry account. This is disabled by default because some subscriptions and regions do not support the required models or quotas during initial validation."
      }
    },
    "blobContainerName": {
      "type": "string",
      "defaultValue": "claims-data",
      "metadata": {
        "description": "Blob container name created in the Storage account for challenge assets."
      }
    },
    "policiesContainerName": {
      "type": "string",
      "defaultValue": "policies",
      "metadata": {
        "description": "Blob container name that stores insurance policy markdown files."
      }
    },
    "searchIndexName": {
      "type": "string",
      "defaultValue": "crash-statements",
      "metadata": {
        "description": "Azure AI Search index name created for Foundry IQ crash statement grounding."
      }
    },
    "allowedEntraUserIds": {
      "type": "array",
      "minLength": 1,
      "metadata": {
        "description": "Microsoft Entra user object IDs that receive the Foundry User role on the Foundry account. At least one participant is required."
      }
    }
  },
  "variables": {
    "prefix": "msagthack",
    "suffix": "[uniqueString(resourceGroup().id)]",
    "storageAccountName": "[replace(format('{0}-sa-{1}', variables('prefix'), variables('suffix')), '-', '')]",
    "searchServiceName": "[format('{0}-search-{1}', variables('prefix'), variables('suffix'))]",
    "aiFoundryName": "[format('{0}-aifoundry-{1}', variables('prefix'), variables('suffix'))]",
    "aiProjectName": "[format('{0}-aiproject-{1}', variables('prefix'), variables('suffix'))]",
    "cognitiveServicesUserRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', 'a97b65f3-24c7-4388-baec-2e87135dc908')]",
    "searchServiceContributorRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7ca78c08-252a-4471-8644-bb5ff32d4ba0')]",
    "searchIndexDataReaderRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '1407120a-92aa-4202-b7e9-c0e197c71c8f')]",
    "foundryUserRoleId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '53ca6127-db72-4b80-b1b0-d745d6d5456d')]",
    "tags": {
      "SecurityControl": "Ignore",
      "CostControl": "Ignore"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-05-01",
      "name": "[variables('storageAccountName')]",
      "location": "[parameters('location')]",
      "tags": "[variables('tags')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {
        "allowBlobPublicAccess": false,
        "networkAcls": {
          "defaultAction": "Allow"
        }
      }
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/default/{1}', variables('storageAccountName'), parameters('blobContainerName'))]",
      "properties": {
        "publicAccess": "None"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
      "apiVersion": "2023-05-01",
      "name": "[format('{0}/default/{1}', variables('storageAccountName'), parameters('policiesContainerName'))]",
      "properties": {
        "publicAccess": "None"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', variables('storageAccountName'))]"
      ]
    },
    {
      "type": "Microsoft.Search/searchServices",
      "apiVersion": "2023-11-01",
      "name": "[variables('searchServiceName')]",
      "location": "[parameters('location')]",
      "tags": "[variables('tags')]",
      "sku": {
        "name": "basic"
      },
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {
        "hostingMode": "default",
        "replicaCount": 1,
        "partitionCount": 1,
        "disableLocalAuth": false,
        "authOptions": {
          "aadOrApiKey": {
            "aadAuthFailureMode": "http401WithBearerChallenge"
          }
        }
      }
    },
    {
      "type": "Microsoft.CognitiveServices/accounts",
      "apiVersion": "2025-04-01-preview",
      "name": "[variables('aiFoundryName')]",
      "location": "[parameters('location')]",
      "tags": "[variables('tags')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "sku": {
        "name": "S0"
      },
      "kind": "AIServices",
      "properties": {
        "allowProjectManagement": true,
        "customSubDomainName": "[variables('aiFoundryName')]",
        "disableLocalAuth": false,
        "publicNetworkAccess": "Enabled"
      }
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName')), parameters('allowedEntraUserIds')[copyIndex()], variables('foundryUserRoleId'))]",
      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryName'))]",
      "copy": {
        "name": "foundryUserAssignments",
        "count": "[length(parameters('allowedEntraUserIds'))]"
      },
      "properties": {
        "roleDefinitionId": "[variables('foundryUserRoleId')]",
        "principalId": "[parameters('allowedEntraUserIds')[copyIndex()]]",
        "principalType": "User"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/projects",
      "apiVersion": "2025-04-01-preview",
      "name": "[format('{0}/{1}', variables('aiFoundryName'), variables('aiProjectName'))]",
      "location": "[parameters('location')]",
      "tags": "[variables('tags')]",
      "identity": {
        "type": "SystemAssigned"
      },
      "properties": {},
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/deployments', variables('aiFoundryName'), 'mistral-document-ai-2512')]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/deployments",
      "apiVersion": "2024-10-01",
      "condition": "[parameters('deployModelDeployments')]",
      "name": "[format('{0}/{1}', variables('aiFoundryName'), 'gpt-5.4')]",
      "sku": {
        "capacity": 200,
        "name": "GlobalStandard"
      },
      "properties": {
        "model": {
          "name": "gpt-5.4",
          "format": "OpenAI"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/deployments",
      "apiVersion": "2025-07-01-preview",
      "condition": "[parameters('deployModelDeployments')]",
      "name": "[format('{0}/{1}', variables('aiFoundryName'), 'mistral-document-ai-2512')]",
      "sku": {
        "name": "GlobalStandard",
        "capacity": 8
      },
      "properties": {
        "model": {
          "format": "Mistral AI",
          "name": "mistral-document-ai-2512",
          "publisher": "Mistral AI",
          "version": "1"
        },
        "raiPolicyName": "Microsoft.DefaultV2",
        "versionUpgradeOption": "OnceNewDefaultVersionAvailable"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/deployments', variables('aiFoundryName'), 'gpt-5.4')]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName')), resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), variables('cognitiveServicesUserRoleId'))]",
      "scope": "[format('Microsoft.CognitiveServices/accounts/{0}', variables('aiFoundryName'))]",
      "properties": {
        "roleDefinitionId": "[variables('cognitiveServicesUserRoleId')]",
        "principalId": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), '2025-04-01-preview', 'full').identity.principalId]",
        "principalType": "ServicePrincipal"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.Search/searchServices', variables('searchServiceName')), resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), variables('searchIndexDataReaderRoleId'))]",
      "scope": "[format('Microsoft.Search/searchServices/{0}', variables('searchServiceName'))]",
      "properties": {
        "roleDefinitionId": "[variables('searchIndexDataReaderRoleId')]",
        "principalId": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), '2025-04-01-preview', 'full').identity.principalId]",
        "principalType": "ServicePrincipal"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.Search/searchServices', variables('searchServiceName')), resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName')), variables('searchServiceContributorRoleId'))]",
      "scope": "[format('Microsoft.Search/searchServices/{0}', variables('searchServiceName'))]",
      "properties": {
        "roleDefinitionId": "[variables('searchServiceContributorRoleId')]",
        "principalId": "[reference(resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName')), '2025-04-01-preview', 'full').identity.principalId]",
        "principalType": "ServicePrincipal"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]"
      ]
    },
    {
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2022-04-01",
      "name": "[guid(resourceId('Microsoft.Search/searchServices', variables('searchServiceName')), resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), variables('searchServiceContributorRoleId'))]",
      "scope": "[format('Microsoft.Search/searchServices/{0}', variables('searchServiceName'))]",
      "properties": {
        "roleDefinitionId": "[variables('searchServiceContributorRoleId')]",
        "principalId": "[reference(resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName')), '2025-04-01-preview', 'full').identity.principalId]",
        "principalType": "ServicePrincipal"
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/connections",
      "apiVersion": "2025-04-01-preview",
      "name": "[format('{0}/{1}-aisearch', variables('aiFoundryName'), variables('aiFoundryName'))]",
      "properties": {
        "category": "CognitiveSearch",
        "target": "[format('https://{0}.search.windows.net', variables('searchServiceName'))]",
        "authType": "ApiKey",
        "isSharedToAll": true,
        "credentials": {
          "key": "[listAdminKeys(resourceId('Microsoft.Search/searchServices', variables('searchServiceName')), '2023-11-01').primaryKey]"
        },
        "metadata": {
          "ApiType": "Azure",
          "ResourceId": "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]",
          "location": "[parameters('location')]"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/projects/connections",
      "apiVersion": "2025-10-01-preview",
      "name": "[format('{0}/{1}/{0}-policies-kb', variables('aiFoundryName'), variables('aiProjectName'))]",
      "properties": {
        "category": "RemoteTool",
        "target": "[format('https://{0}.search.windows.net/knowledgebases/policies-kb/mcp?api-version=2026-08-01-preview', variables('searchServiceName'))]",
        "authType": "ProjectManagedIdentity",
        "audience": "https://search.azure.com/",
        "isSharedToAll": true,
        "metadata": {
          "ApiType": "Azure"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/connections', variables('aiFoundryName'), format('{0}-aisearch', variables('aiFoundryName')))]"
      ]
    },
    {
      "type": "Microsoft.CognitiveServices/accounts/projects/connections",
      "apiVersion": "2025-10-01-preview",
      "name": "[format('{0}/{1}/{0}-crash-statements-kb', variables('aiFoundryName'), variables('aiProjectName'))]",
      "properties": {
        "category": "RemoteTool",
        "target": "[format('https://{0}.search.windows.net/knowledgebases/crash-statements-kb/mcp?api-version=2026-08-01-preview', variables('searchServiceName'))]",
        "authType": "ProjectManagedIdentity",
        "audience": "https://search.azure.com/",
        "isSharedToAll": true,
        "metadata": {
          "ApiType": "Azure"
        }
      },
      "dependsOn": [
        "[resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/projects', variables('aiFoundryName'), variables('aiProjectName'))]",
        "[resourceId('Microsoft.Search/searchServices', variables('searchServiceName'))]",
        "[resourceId('Microsoft.CognitiveServices/accounts/projects/connections', variables('aiFoundryName'), variables('aiProjectName'), format('{0}-policies-kb', variables('aiFoundryName')))]"
      ]
    }
  ],
  "outputs": {
    "storageAccountName": {
      "type": "string",
      "value": "[variables('storageAccountName')]"
    },
    "blobContainerName": {
      "type": "string",
      "value": "[parameters('blobContainerName')]"
    },
    "policiesContainerName": {
      "type": "string",
      "value": "[parameters('policiesContainerName')]"
    },
    "searchServiceName": {
      "type": "string",
      "value": "[variables('searchServiceName')]"
    },
    "searchIndexName": {
      "type": "string",
      "value": "[parameters('searchIndexName')]"
    },
    "aiFoundryHubName": {
      "type": "string",
      "value": "[variables('aiFoundryName')]"
    },
    "aiFoundryProjectName": {
      "type": "string",
      "value": "[variables('aiProjectName')]"
    },
    "searchServiceEndpoint": {
      "type": "string",
      "value": "[format('https://{0}.search.windows.net/', variables('searchServiceName'))]"
    },
    "aiFoundryHubEndpoint": {
      "type": "string",
      "value": "[format('https://ml.azure.com/home?wsid={0}', resourceId('Microsoft.CognitiveServices/accounts', variables('aiFoundryName')))]"
    },
    "aiFoundryProjectEndpoint": {
      "type": "string",
      "value": "[format('https://{0}.services.ai.azure.com/api/projects/{1}', variables('aiFoundryName'), variables('aiProjectName'))]"
    }
  }
}