azuredeploy.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "languageVersion": "2.0",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_generator": {
      "name": "bicep",
      "version": "0.37.4.10188",
      "templateHash": "18084735929345665494"
    }
  },
  "parameters": {
    "tenantId": {
      "type": "string",
      "defaultValue": "[tenant().tenantId]",
      "metadata": {
        "description": "Id (guid) of the tenant of the D365FO environment.\nYou can find the tenant id in the about form of the D365FO environment in the licenses section under the name \"Serial number\".\nBy default, the tenant id of the Azure Directory where this template is deployed will be used.\n"
      }
    },
    "d365FOEnvironmentUrl": {
      "type": "string",
      "defaultValue": "https://d365fo-environment-url.dynamics.com",
      "metadata": {
        "description": "URL of the D365FO environment.\n"
      }
    },
    "clientId": {
      "type": "string",
      "defaultValue": "00000000-0000-0000-0000-000000000000",
      "metadata": {
        "description": "Id (guid) of app registration client for OAuth2.0 authentication with D365FO environment. \nSee https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/data-entities/services-home-page#authentication for more details.\nWill be stored as a named value in API Management.\n"
      }
    },
    "clientSecret": {
      "type": "securestring",
      "metadata": {
        "description": "Client secret for OAuth2.0 authentication with D365FO environment. \nSee https://learn.microsoft.com/en-us/dynamics365/fin-ops-core/dev-itpro/data-entities/services-home-page#authentication for more details.\nWill be stored as a secret named value in API Management.\n"
      }
    }
  },
  "variables": {
    "$fxv#0": "openapi: 3.0.1\ninfo:\n  title: D365FO\n  version: '0.1'\npaths:\n  /*:\n    patch:\n      summary: PATCH\n      operationId: PATCH\n      responses:\n        '200':\n          description: ''\n    delete:\n      summary: DELETE\n      operationId: DELETE\n      responses:\n        '200':\n          description: ''\n    get:\n      summary: GET\n      operationId: GET\n      responses:\n        '200':\n          description: ''\n    put:\n      summary: PUT\n      operationId: PUT\n      responses:\n        '200':\n          description: ''\n    post:\n      summary: POST\n      operationId: POST\n      responses:\n        '200':\n          description: ''\ncomponents:\n  securitySchemes:\n    apiKeyHeader:\n      type: apiKey\n      name: Ocp-Apim-Subscription-Key\n      in: header\n    apiKeyQuery:\n      type: apiKey\n      name: subscription-key\n      in: query\nsecurity:\n  - apiKeyHeader: [ ]\n  - apiKeyQuery: [ ]",
    "$fxv#1": "<!--\n    IMPORTANT:\n    - Policy elements can appear only within the <inbound>, <outbound>, <backend> section elements.\n    - To apply a policy to the incoming request (before it is forwarded to the backend service), place a corresponding policy element within the <inbound> section element.\n    - To apply a policy to the outgoing response (before it is sent back to the caller), place a corresponding policy element within the <outbound> section element.\n    - To add a policy, place the cursor at the desired insertion point and select a policy from the sidebar.\n    - To remove a policy, delete the corresponding policy statement from the policy document.\n    - Position the <base> element within a section element to inherit all policies from the corresponding section element in the enclosing scope.\n    - Remove the <base> element to prevent inheriting policies from the corresponding section element in the enclosing scope.\n    - Policies are applied in the order of their appearance, from the top down.\n    - Comments within policy elements are not supported and may disappear. Place your comments between policy elements or at a higher level scope.\n-->\n<policies>\n\t<inbound>\n\t\t<base />\n\t\t<!-- Log all incoming request headers -->\n\t\t<include-fragment fragment-id=\"LogHeaders\" />\n\t\t<!-- Allow requester to determine backend based on Environment header -->\n\t\t<include-fragment fragment-id=\"SetEnvironmentVariable\" />\n\t\t<include-fragment fragment-id=\"SetServiceBackendBasedOnEnvironmentVariable\" />\n\t\t<!-- Get OAuth bearer token for authentication with D365FO -->\n\t\t<include-fragment fragment-id=\"SetMicrosoftOAuthorizationHeaderCached\" />\n\t\t<!-- Add cross-company=true parameter to all requests -->\n\t\t<include-fragment fragment-id=\"AddCrossCompanyParameter\" />\n\t</inbound>\n\t<backend>\n\t\t<base />\n\t</backend>\n\t<outbound>\n\t\t<base />\n\t</outbound>\n\t<on-error>\n\t\t<base />\n\t</on-error>\n</policies>",
    "policyFragments": "[variables('_1.fragments')]",
    "applicationInsightsName": "[format('appInsights{0}', uniqueString(resourceGroup().id))]",
    "appInsightsInstrumentationKeyNamedValueName": "ApplicationInsightsInstrumentationKey",
    "logSettings": {
      "request": {
        "body": {
          "bytes": 8192
        }
      },
      "response": {
        "body": {
          "bytes": 8192
        }
      }
    },
    "_1._2": "<!--\n    - <inbound> fragment\n-->\n<fragment>\n\t<set-query-parameter name=\"cross-company\" exists-action=\"override\">\n\t\t<value>true</value>\n\t</set-query-parameter>\n</fragment>",
    "_1._3": "<!--\n    - <outbound> fragment\n-->\n<fragment>\n\t<retry condition=\"@(context.Response.StatusCode == 429)\" count=\"3\" interval=\"10\" first-fast-retry=\"false\" />\n</fragment>",
    "_1._4": "<!-- \n    - <inbound> fragment\n-->\n<fragment>\n\t<set-variable name=\"environment\" value=\"@(context.Request.Headers.GetValueOrDefault(&quot;Environment&quot;, &quot;{{DefaultD365FOEnvironment}}&quot;))\" />\n</fragment>",
    "_1._5": "<!--\n    IMPORTANT:\n    - <inbound> fragment\n    - Requires the environment variable. Best used in combination with SetEnvironmentVariable fragment.\n    - Also requires the following named values\n        - {{TenantId}}\n        - {{D365FOClientId}}\n        - {{D365FOClientSecret}}\n-->\n<fragment>\n\t<!-- Fetch token from cache -->\n\t<cache-lookup-value key=\"@((string)context.Variables[&quot;environment&quot;] + &quot;-token-{{D365FOClientId}}&quot;)\" variable-name=\"bearerToken\" />\n\t<choose>\n\t\t<!-- When a bearerToken is not available in cache -->\n\t\t<when condition=\"@(!context.Variables.ContainsKey(&quot;bearerToken&quot;))\">\n\t\t\t<send-request mode=\"new\" response-variable-name=\"oauthResponse\" timeout=\"20\" ignore-error=\"false\">\n\t\t\t\t<set-url>https://login.microsoftonline.com/{{TenantId}}/oauth2/token</set-url>\n\t\t\t\t<set-method>POST</set-method>\n\t\t\t\t<set-header name=\"Content-Type\" exists-action=\"override\">\n\t\t\t\t\t<value>application/x-www-form-urlencoded</value>\n\t\t\t\t</set-header>\n\t\t\t\t<set-body>@{ \n                    return \"client_id={{D365FOClientId}}&amp;resource=\" + \n                        context.Variables.GetValueOrDefault&lt;string&gt;(\"environment\") + \n                        \"&amp;client_secret={{D365FOClientSecret}}&amp;grant_type=client_credentials\"; \n                }</set-body>\n\t\t\t</send-request>\n\t\t\t<!-- Store result in cache -->\n\t\t\t<set-variable name=\"accessToken\" value=\"@((string)((IResponse)context.Variables[&quot;oauthResponse&quot;]).Body.As&lt;JObject&gt;()[&quot;access_token&quot;])\" />\n\t\t\t<cache-store-value key=\"@((string)context.Variables[&quot;environment&quot;] + &quot;-token-{{D365FOClientId}}&quot;)\" value=\"@((string)context.Variables[&quot;accessToken&quot;])\" duration=\"1200\" />\n\t\t\t<set-header name=\"Authorization\" exists-action=\"override\">\n\t\t\t\t<value>@(\"bearer \" + (string)context.Variables[\"accessToken\"])</value>\n\t\t\t</set-header>\n\t\t</when>\n\t\t<!-- If cache value exists -->\n\t\t<otherwise>\n\t\t\t<set-header name=\"Authorization\" exists-action=\"override\">\n\t\t\t\t<value>@(\"bearer \" + (string)context.Variables[\"bearerToken\"])</value>\n\t\t\t</set-header>\n\t\t</otherwise>\n\t</choose>\n</fragment>",
    "_1._6": "<!--\n    IMPORTANT:\n    - <inbound> fragment\n    - Requires the environment variable. Should be used in combination with the SetEnvironmentVariable fragment.\n-->\n<fragment>\n\t<set-backend-service base-url=\"@(context.Variables.GetValueOrDefault&lt;string&gt;(&quot;environment&quot;))\" />\n</fragment>",
    "_1._7": "<!--\n    - <inbound> fragment\n-->\n<fragment>\n\t<!-- Serialize headers with line breaks -->\n\t<set-variable name=\"allHeaders\" value=\"@{\n\t\treturn string.Join(\n\t\t\t&quot;\\n&quot;,\n\t\t\tcontext.Request.Headers\n\t\t\t\t.Where(h =&gt; h.Key != &quot;Authorization&quot; &amp;&amp; h.Key != &quot;Ocp-Apim-Subscription-Key&quot;)\n\t\t\t\t.Select(h =&gt; h.Key + &quot;: &quot; + string.Join(&quot;, &quot;, h.Value))\n\t\t);\n\t}\" />\n\t<!-- Output to trace -->\n\t<trace source=\"log-all-headers\" severity=\"information\">\n        @{\n            return \"Request Headers:\\n\" + context.Variables[\"allHeaders\"];\n        }\n    </trace>\n</fragment>",
    "_1.AddCrossCompanyParameterFragment": {
      "name": "AddCrossCompanyParameter",
      "value": "[variables('_1._2')]",
      "description": "Adds the cross-company=true parameter to all requests."
    },
    "_1.fragments": [
      "[variables('_1.AddCrossCompanyParameterFragment')]",
      "[variables('_1.RetryOn429StatusCodeFragment')]",
      "[variables('_1.SetEnvironmentVariableFragment')]",
      "[variables('_1.SetMicrosoftOAuthorizationHeaderCachedFragment')]",
      "[variables('_1.SetServiceBackendBasedOnEnvironmentVariableFragment')]",
      "[variables('_1.LogHeadersFragment')]"
    ],
    "_1.LogHeadersFragment": {
      "name": "LogHeaders",
      "value": "[variables('_1._7')]",
      "description": "Logs all incoming request headers for debugging purposes."
    },
    "_1.RetryOn429StatusCodeFragment": {
      "name": "RetryOn429StatusCode",
      "value": "[variables('_1._3')]",
      "description": "On status code 429 (Too Many Requests), retries the request 3 times with a delay of 10 seconds."
    },
    "_1.SetEnvironmentVariableFragment": {
      "name": "SetEnvironmentVariable",
      "value": "[variables('_1._4')]",
      "description": "Sets the variable \"environment\". The value is either taken from the \"Environment\" request header or from the DefaultD365FOEnvironment named value."
    },
    "_1.SetMicrosoftOAuthorizationHeaderCachedFragment": {
      "name": "SetMicrosoftOAuthorizationHeaderCached",
      "value": "[variables('_1._5')]",
      "description": "Gets an OAuth token to authorize requests to the D365FO environment. The token is requested based on the D365FOClientId, D365FOClientSecret and TenantId named values. The token is cached for 20 minutes."
    },
    "_1.SetServiceBackendBasedOnEnvironmentVariableFragment": {
      "name": "SetServiceBackendBasedOnEnvironmentVariable",
      "value": "[variables('_1._6')]",
      "description": "Sets the backend service based on the \"environment\" variable. The variable is set by the SetEnvironmentVariableFragment."
    }
  },
  "resources": {
    "apiManagement": {
      "type": "Microsoft.ApiManagement/service",
      "apiVersion": "2024-05-01",
      "name": "[format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5))]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Consumption",
        "capacity": 0
      },
      "properties": {
        "publisherEmail": "[deployer().userPrincipalName]",
        "publisherName": "[tenant().displayName]"
      }
    },
    "d365FOUrlNamedValue": {
      "type": "Microsoft.ApiManagement/service/namedValues",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'DefaultD365FOEnvironment')]",
      "properties": {
        "displayName": "DefaultD365FOEnvironment",
        "value": "[parameters('d365FOEnvironmentUrl')]"
      },
      "dependsOn": [
        "apiManagement"
      ]
    },
    "clientIdNamedValue": {
      "type": "Microsoft.ApiManagement/service/namedValues",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'D365FOClientId')]",
      "properties": {
        "displayName": "D365FOClientId",
        "value": "[parameters('clientId')]"
      },
      "dependsOn": [
        "apiManagement"
      ]
    },
    "clientSecretNamedValue": {
      "type": "Microsoft.ApiManagement/service/namedValues",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'D365FOClientSecret')]",
      "properties": {
        "displayName": "D365FOClientSecret",
        "secret": true,
        "value": "[parameters('clientSecret')]"
      },
      "dependsOn": [
        "apiManagement"
      ]
    },
    "tenantNamedValue": {
      "type": "Microsoft.ApiManagement/service/namedValues",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'TenantId')]",
      "properties": {
        "displayName": "TenantId",
        "value": "[parameters('tenantId')]"
      },
      "dependsOn": [
        "apiManagement"
      ]
    },
    "policyFragmentsResources": {
      "copy": {
        "name": "policyFragmentsResources",
        "count": "[length(variables('policyFragments'))]"
      },
      "type": "Microsoft.ApiManagement/service/policyFragments",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), variables('policyFragments')[copyIndex()].name)]",
      "properties": {
        "value": "[variables('policyFragments')[copyIndex()].value]",
        "description": "[variables('policyFragments')[copyIndex()].description]"
      },
      "dependsOn": [
        "apiManagement",
        "clientIdNamedValue",
        "clientSecretNamedValue",
        "d365FOUrlNamedValue",
        "tenantNamedValue"
      ]
    },
    "d365foApi": {
      "type": "Microsoft.ApiManagement/service/apis",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'D365FOAPI')]",
      "properties": {
        "displayName": "D365FO API",
        "format": "openapi",
        "value": "[variables('$fxv#0')]",
        "path": "/d365fo",
        "protocols": [
          "https"
        ]
      },
      "dependsOn": [
        "apiManagement"
      ]
    },
    "d365foApiPolicy": {
      "type": "Microsoft.ApiManagement/service/apis/policies",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}/{2}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'D365FOAPI', 'policy')]",
      "properties": {
        "value": "[variables('$fxv#1')]"
      },
      "dependsOn": [
        "d365foApi",
        "policyFragmentsResources"
      ]
    },
    "secretNamedValueAppInsights": {
      "type": "Microsoft.ApiManagement/service/namedValues",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), variables('appInsightsInstrumentationKeyNamedValueName'))]",
      "properties": {
        "displayName": "[variables('appInsightsInstrumentationKeyNamedValueName')]",
        "secret": true,
        "value": "[listOutputsWithSecureValues('appInsights', '2022-09-01').applicationInsightsInstrumentationKey]"
      },
      "dependsOn": [
        "apiManagement",
        "appInsights"
      ]
    },
    "apimLogger": {
      "type": "Microsoft.ApiManagement/service/loggers",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), variables('applicationInsightsName'))]",
      "properties": {
        "loggerType": "applicationInsights",
        "isBuffered": true,
        "credentials": {
          "instrumentationKey": "[format('{{{{{0}}}}}', variables('appInsightsInstrumentationKeyNamedValueName'))]"
        }
      },
      "dependsOn": [
        "apiManagement",
        "secretNamedValueAppInsights"
      ]
    },
    "d365foApiDiagnostics": {
      "type": "Microsoft.ApiManagement/service/apis/diagnostics",
      "apiVersion": "2024-05-01",
      "name": "[format('{0}/{1}/{2}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), 'D365FOAPI', 'applicationinsights')]",
      "properties": {
        "loggerId": "[resourceId('Microsoft.ApiManagement/service/loggers', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)), variables('applicationInsightsName'))]",
        "alwaysLog": "allErrors",
        "logClientIp": true,
        "sampling": {
          "samplingType": "fixed",
          "percentage": 100
        },
        "frontend": "[variables('logSettings')]",
        "backend": "[variables('logSettings')]"
      },
      "dependsOn": [
        "apimLogger",
        "d365foApi"
      ]
    },
    "apimServiceDiagnostics": {
      "type": "Microsoft.Insights/diagnosticSettings",
      "apiVersion": "2021-05-01-preview",
      "scope": "[format('Microsoft.ApiManagement/service/{0}', format('D365FOAPIManagement-{0}', take(uniqueString(tenant().tenantId, resourceGroup().id), 5)))]",
      "name": "APIMAnalytics",
      "properties": {
        "workspaceId": "[reference('appInsights').outputs.logAnalyticsWorkspaceId.value]",
        "logs": [
          {
            "category": "GatewayLogs",
            "enabled": true
          }
        ],
        "metrics": [
          {
            "category": "AllMetrics",
            "enabled": true
          }
        ]
      },
      "dependsOn": [
        "apiManagement",
        "appInsights"
      ]
    },
    "appInsights": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2022-09-01",
      "name": "D365FOAPIManagementMonitoring",
      "properties": {
        "expressionEvaluationOptions": {
          "scope": "inner"
        },
        "mode": "Incremental",
        "parameters": {
          "applicationInsightsName": {
            "value": "[variables('applicationInsightsName')]"
          }
        },
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "languageVersion": "2.0",
          "contentVersion": "1.0.0.0",
          "metadata": {
            "_generator": {
              "name": "bicep",
              "version": "0.37.4.10188",
              "templateHash": "11847530913114245845"
            }
          },
          "parameters": {
            "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                "description": "Specifies the location in which the Azure Storage resources should be deployed."
              }
            },
            "applicationInsightsName": {
              "type": "string",
              "defaultValue": "[format('appInsigths{0}', uniqueString(resourceGroup().id))]",
              "metadata": {
                "description": "Specifies the name of the Applications Insights resource."
              }
            },
            "logAnalyticsWorkspaceName": {
              "type": "string",
              "defaultValue": "[format('logAnalytics{0}', uniqueString(resourceGroup().id))]",
              "metadata": {
                "description": "Specifies the name of the Log Analytics Workspace resource."
              }
            }
          },
          "resources": {
            "logAnalyticsWorkspace": {
              "type": "Microsoft.OperationalInsights/workspaces",
              "apiVersion": "2023-09-01",
              "name": "[parameters('logAnalyticsWorkspaceName')]",
              "location": "[parameters('location')]",
              "properties": {
                "sku": {
                  "name": "PerGB2018"
                }
              }
            },
            "appInsights": {
              "type": "Microsoft.Insights/components",
              "apiVersion": "2020-02-02",
              "name": "[parameters('applicationInsightsName')]",
              "location": "[parameters('location')]",
              "kind": "web",
              "properties": {
                "Application_Type": "web",
                "WorkspaceResourceId": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
              },
              "dependsOn": [
                "logAnalyticsWorkspace"
              ]
            }
          },
          "outputs": {
            "applicationInsightsName": {
              "type": "string",
              "value": "[parameters('applicationInsightsName')]"
            },
            "applicationInsightsInstrumentationKey": {
              "type": "securestring",
              "value": "[reference('appInsights').InstrumentationKey]"
            },
            "logAnalyticsWorkspaceId": {
              "type": "string",
              "value": "[resourceId('Microsoft.OperationalInsights/workspaces', parameters('logAnalyticsWorkspaceName'))]"
            }
          }
        }
      }
    }
  }
}