feat: Create Entra identities with Bicep

[picccard]

Intro

Looking to do more with bicep and have less in the deploy.ps1. Would like to have ARM handle most of the input validation.

Bicep templates for Microsoft Graph resources is still in public preview

Bicep deployments

The Entra Id app registrations and Azure infrastructure is bundled into seperate main.bicep files.

• deploy/identity/main.bicep
• deploy/main.bicep (move infra.bicep to its own subfolder?)

1. deploy app reg (bicep)
2. deploy infra (bicep)
3. build and container image to ACR (az acr build)
4. build .zip and publish to App Service or Function (pwsh)

Configuration

All configuration should be done in .bicepparam-files.

Challenges

The Entra Id app registration deployment has circular dependencies (both depend on values from the other for a complete setup):

• Engine app should include uiAppId as knownClientApplications.
• UI app should include engineAppId in requiredResourceAccess.

The redirectUri for the UI app might not be known until after the infrastructure is deployed.

Solution

The Entra Id app registration deployment is done twice.

• The initial deployment happens without any value for the params uiAppId & engineAppId, and a placeholder value for uiAppRedirectUris.
• Successive deployments include the params uiAppId & engineAppId, and uiAppRedirectUris can be change at any point.

Flexible deployment options

The identity/main.bicep & infra/main.bicep can be deployed with:

1. One pipeline deploying both
2. One powershell script deploying both
3. Two different pipelines deploying one part each
4. Two different powershell scripts deploying one part each

Example setup

1. Deploy Entra Id app registration without uiAppId & engineAppId, and a placeholder value for uiAppRedirectUris.
2. Deploy the Azure infrastructure.
3. Deploy Entra Id app registration with the now known values for uiAppId, engineAppId, uiAppRedirectUris.

The deploy directory includes the following example scripts: deploy-identity.ps1, deploy-infrastructure.ps1 and deploy-all.ps1.

[DCMattyG]

Hey @picccard, while I love that we're able to move some of the Identity items to Bicep now, I'm hesitant to break this into multiple deployment scripts. I'd prefer a single, easy to use script for the majority of users whom just want the "easy button" deployment. We can also have some more advanced options for power users where they can have other options (like you've provided) of more granular deployment scripts, purely Bicep, or even perhaps Terraform.

I hope that makes sense, but the net/net is we should keep the single "easy" deployment script and add additional options for Power Users whom perhaps want to add these steps into pipelines or other CI/CD processes within their own environment.

Please let me know your thoughts or perhaps if I've misinterpreted your changes proposed here, and thank you for the wonderful contributions as always!