templates/azure-local-deployment-template-san.json

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "languageVersion": "2.0",
  "contentVersion": "1.0.0.0",
  "metadata": {
    "_description": "Azure Local 24H2+ Disaggregated cluster (SAN storage). Adapted from https://github.com/Azure/azure-quickstart-templates/tree/master/quickstarts/microsoft.azurestackhci/create-cluster-san"
  },
  "parameters": {
    "deploymentMode": {
      "defaultValue": "Validate",
      "type": "string",
      "allowedValues": [ "Validate", "Deploy" ],
      "metadata": { "description": "First must pass Validate prior running Deploy" }
    },
    "keyVaultName": { "type": "string", "metadata": { "description": "The KeyVault name used to store the secrets." } },
    "createNewKeyVault": { "type": "bool", "defaultValue": true },
    "softDeleteRetentionDays": { "type": "int", "defaultValue": 30 },
    "diagnosticStorageAccountName": { "type": "string" },
    "logsRetentionInDays": { "type": "int", "defaultValue": 30, "minValue": 0, "maxValue": 365 },
    "storageAccountType": {
      "type": "string",
      "defaultValue": "Standard_LRS",
      "allowedValues": [
        "Premium_LRS", "Premium_ZRS", "Standard_GRS", "Standard_GZRS",
        "Standard_LRS", "Standard_RAGRS", "Standard_RAGZRS", "Standard_ZRS"
      ]
    },
    "clusterName": { "type": "string", "minLength": 3, "maxLength": 15 },
    "location": { "type": "string", "defaultValue": "[resourceGroup().location]" },
    "tenantId": { "type": "string", "defaultValue": "[subscription().tenantId]" },
    "witnessType": { "type": "string", "defaultValue": "No Witness", "allowedValues": [ "Cloud", "No Witness" ] },
    "clusterWitnessStorageAccountName": { "type": "string", "defaultValue": "" },
    "localAdminUserName": { "type": "string", "minLength": 1 },
    "localAdminPassword": { "type": "securestring", "minLength": 1 },
    "AzureStackLCMAdminUsername": { "type": "string", "minLength": 1 },
    "AzureStackLCMAdminPassword": { "type": "securestring", "minLength": 1 },
    "hciResourceProviderObjectID": { "type": "string", "minLength": 1 },
    "arcNodeResourceIds": { "type": "array", "defaultValue": [] },
    "domainFqdn": { "type": "string", "defaultValue": "" },
    "namingPrefix": { "type": "string", "defaultValue": "hci" },
    "adouPath": { "type": "string", "defaultValue": "" },
    "securityLevel": { "type": "string", "defaultValue": "Recommended", "allowedValues": [ "Recommended", "Customized" ] },
    "driftControlEnforced": { "type": "bool", "defaultValue": true },
    "credentialGuardEnforced": { "type": "bool", "defaultValue": true },
    "smbSigningEnforced": { "type": "bool", "defaultValue": true },
    "smbClusterEncryption": { "type": "bool", "defaultValue": false },
    "bitlockerBootVolume": { "type": "bool", "defaultValue": true },
    "bitlockerDataVolumes": { "type": "bool", "defaultValue": true },
    "wdacEnforced": { "type": "bool", "defaultValue": true },
    "streamingDataClient": { "type": "bool", "defaultValue": true },
    "euLocation": { "type": "bool", "defaultValue": false },
    "episodicDataUpload": { "type": "bool", "defaultValue": true },
    "configurationMode": {
      "type": "string",
      "defaultValue": "InfraOnly",
      "allowedValues": [ "InfraOnly" ],
      "metadata": { "description": "InfraOnly is the only supported value for SAN/Disaggregated" }
    },
    "infraVolLunId": {
      "type": "string",
      "defaultValue": "",
      "metadata": { "description": "Infrastructure volume LUN ID (e.g. PURE1234567890ABCDEF)." }
    },
    "infraPerfLunId": {
      "type": "string",
      "defaultValue": "",
      "metadata": { "description": "Infrastructure performance LUN ID (e.g. PURE0987654321MNOPQR)." }
    },
    "subnetMask": { "type": "string", "defaultValue": "" },
    "defaultGateway": { "type": "string", "defaultValue": "" },
    "startingIPAddress": { "type": "string", "defaultValue": "" },
    "endingIPAddress": { "type": "string", "defaultValue": "" },
    "dnsServers": { "type": "array", "defaultValue": [ "" ] },
    "useDhcp": { "type": "bool", "defaultValue": false },
    "physicalNodesSettings": { "type": "array", "defaultValue": [] },
    "networkingType": {
      "type": "string",
      "defaultValue": "switchedMultiServerDeployment",
      "allowedValues": [ "switchedMultiServerDeployment", "switchlessMultiServerDeployment", "singleServerDeployment" ]
    },
    "networkingPattern": {
      "type": "string",
      "defaultValue": "hyperConverged",
      "allowedValues": [ "hyperConverged", "convergedManagementCompute", "convergedComputeStorage", "custom" ]
    },
    "intentList": { "type": "array", "defaultValue": [] },
    "sanNetworkList": {
      "type": "object",
      "defaultValue": {},
      "metadata": { "description": "SAN network configuration: clusterNetworkConfig.adapterProperties + clusterNetworkConfig.adapterIPConfig[]" }
    },
    "storageConnectivitySwitchless": { "type": "bool", "defaultValue": false },
    "customLocation": { "type": "string", "defaultValue": "" },
    "sbeVersion": { "type": "string", "defaultValue": "" },
    "sbeFamily": { "type": "string", "defaultValue": "" },
    "sbePublisher": { "type": "string", "defaultValue": "" },
    "sbeManifestSource": { "type": "string", "defaultValue": "" },
    "sbeManifestCreationDate": { "type": "string", "defaultValue": "" },
    "partnerProperties": { "type": "array", "defaultValue": [] },
    "partnerCredentiallist": { "type": "array", "defaultValue": [] }
  },
  "variables": {
    "storageWitnessECEName": "WitnessStorageKey",
    "LocalAdminCredentialECEName": "LocalAdminCredential",
    "domainAdminCredentialECEName": "AzureStackLCMUserCredential",
    "storageWitnessSecretName": "[concat( parameters('clusterName'), '-', 'WitnessStorageKey')]",
    "LocalAdminCredentialSecretName": "[concat( parameters('clusterName'), '-', 'LocalAdminCredential')]",
    "domainAdminSecretName": "[concat( parameters('clusterName'), '-', 'AzureStackLCMUserCredential')]",
    "witnessTypeVar": "[if(equals(parameters('witnessType'), 'No Witness'), '','Cloud')]",
    "clusterWitnessStorageAccountNameVar": "[if(equals(parameters('witnessType'), 'No Witness'), '', parameters('clusterWitnessStorageAccountName'))]",
    "AzureServiceEndpointVar": "[if(equals(parameters('witnessType'), 'No Witness'), '', if(equals(environment().name, 'AzureCloud'), 'core.windows.net', 'core.usgovcloudapi.net'))]",
    "localAdminSecretValue": "[base64(concat(parameters('localAdminUserName'),':',parameters('localAdminPassword')))]",
    "domainAdminSecretValueVar": "[base64(concat(parameters('AzureStackLCMAdminUsername'),':',parameters('AzureStackLCMAdminPassword')))]",
    "CloudWithnessStorageAccountIdVar": "[resourceId('Microsoft.Storage/storageAccounts', parameters('clusterWitnessStorageAccountName'))]",
    "KeyVaultDNS": "[if(equals(environment().name, 'AzureCloud'), 'vault.azure.net', 'vault.usgovcloudapi.net')]",
    "copy": [
      {
        "name": "answerfileSBESecrets",
        "count": "[length(parameters('partnerCredentialList'))]",
        "input": {
          "secretName": "[parameters('partnerCredentialList')[copyIndex('answerfileSBESecrets')].secretName]",
          "eceSecretName": "[parameters('partnerCredentialList')[copyIndex('answerfileSBESecrets')].secretName]",
          "secretLocation": "[concat('https://', parameters('keyVaultName'), '.', variables('KeyVaultDNS'), '/secrets/', parameters('partnerCredentialList')[copyIndex('answerfileSBESecrets')].secretName)]"
        }
      },
      {
        "name": "isNodeNameValid",
        "count": "[length(parameters('physicalNodesSettings'))]",
        "input": "[if(equals(parameters('clusterName'), parameters('physicalNodesSettings')[copyIndex('isNodeNameValid')].name), 'false', 'true')]"
      }
    ],
    "deploymentSecretsList": [
      {
        "secretName": "[variables('storageWitnessSecretName')]",
        "eceSecretName": "[variables('storageWitnessECEName')]",
        "secretLocation": "[concat('https://', parameters('keyVaultName'), '.', variables('KeyVaultDNS'), '/secrets/', variables('storageWitnessSecretName'))]"
      },
      {
        "secretName": "[variables('LocalAdminCredentialSecretName')]",
        "eceSecretName": "[variables('LocalAdminCredentialECEName')]",
        "secretLocation": "[concat('https://', parameters('keyVaultName'), '.', variables('KeyVaultDNS'), '/secrets/', variables('LocalAdminCredentialSecretName'))]"
      },
      {
        "secretName": "[variables('domainAdminSecretName')]",
        "eceSecretName": "[variables('domainAdminCredentialECEName')]",
        "secretLocation": "[concat('https://', parameters('keyVaultName'), '.', variables('KeyVaultDNS'), '/secrets/', variables('domainAdminSecretName'))]"
      }
    ]
  },
  "resources": {
    "witnessStorageAcc": {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "[parameters('clusterWitnessStorageAccountName')]",
      "location": "[parameters('location')]",
      "condition": "[not(equals(parameters('witnessType'), 'No Witness'))]",
      "sku": { "name": "[parameters('storageAccountType')]", "tier": "Standard" },
      "kind": "StorageV2",
      "properties": { "supportsHttpsTrafficOnly": true, "minimumTlsVersion": "TLS1_2" }
    },
    "hcirproleassignment": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "AzureConnectedMachineResourceManager-RoleAssignment",
      "subscriptionId": "[subscription().subscriptionId]",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": { "hciResourceProviderObjectID1": { "type": "string" } },
          "variables": {},
          "resources": [
            {
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(concat('HCIRP-',resourceGroup().id, parameters('hciResourceProviderObjectID1')))]",
              "properties": {
                "mode": "Incremental",
                "roleDefinitionId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/', 'f5819b54-e033-4d82-ac66-4fec3cbf3f4c')]",
                "principalId": "[parameters('hciResourceProviderObjectID1')]",
                "scope": "[resourceGroup().id]",
                "description": "Azure Connected Machine Resource Manager role assignment to HCI Resource Provider"
              }
            }
          ]
        },
        "parameters": { "hciResourceProviderObjectID1": { "value": "[parameters('hciResourceProviderObjectID')]" } }
      }
    },
    "edgeDevices": {
      "condition": "[equals(parameters('deploymentMode'), 'Validate')]",
      "dependsOn": [ "hcirproleassignment" ],
      "copy": { "name": "edgeDeviceCopy", "count": "[length(parameters('arcNodeResourceIds'))]" },
      "type": "Microsoft.AzureStackHCI/edgeDevices",
      "apiVersion": "2026-04-01-preview",
      "name": "default",
      "scope": "[concat('Microsoft.HybridCompute/machines', '/', last(split(parameters('arcNodeResourceIds')[copyindex()], '/')))]",
      "kind": "HCI",
      "properties": {}
    },
    "arcMachineRoleAssignment": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "AzureStackHCIDeviceManagementRole-RoleAssignment",
      "subscriptionId": "[subscription().subscriptionId]",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": { "arcNodeResourceIds1": { "type": "array" } },
          "variables": {},
          "resources": [
            {
              "copy": { "name": "DVMroleAssignmentCopy", "count": "[length(parameters('arcNodeResourceIds1'))]" },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(concat('DMR-', parameters('arcNodeResourceIds1')[copyIndex()]))]",
              "properties": {
                "mode": "Incremental",
                "roleDefinitionId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/', '865ae368-6a45-4bd1-8fbf-0d5151f56fc1')]",
                "principalId": "[reference(parameters('arcNodeResourceIds1')[copyIndex()], '2023-10-03-preview', 'full').identity.principalId]",
                "scope": "[resourceGroup().id]",
                "description": "[concat(substring(parameters('arcNodeResourceIds1')[copyIndex()],lastIndexOf(parameters('arcNodeResourceIds1')[copyIndex()],'/')),'- Azure Stack HCI Device Management Role')]"
              }
            }
          ]
        },
        "parameters": { "arcNodeResourceIds1": { "value": "[parameters('arcNodeResourceIds')]" } }
      }
    },
    "ArcMachineKVRoleAssignment": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "KeyVaultSecretsUser-RoleAssignment",
      "subscriptionId": "[subscription().subscriptionId]",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": { "arcNodeResourceIds1": { "type": "array" } },
          "variables": {},
          "resources": [
            {
              "copy": { "name": "KVroleAssignmentCopy", "count": "[length(parameters('arcNodeResourceIds1'))]" },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(concat('KVSU-RoleAssign', parameters('arcNodeResourceIds1')[copyIndex()]))]",
              "properties": {
                "mode": "Incremental",
                "roleDefinitionId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/', '4633458b-17de-408a-b874-0445c86b69e6')]",
                "principalId": "[reference(parameters('arcNodeResourceIds1')[copyIndex()], '2023-10-03-preview', 'full').identity.principalId]",
                "scope": "[resourceGroup().id]",
                "description": "[concat(substring(parameters('arcNodeResourceIds1')[copyIndex()],lastIndexOf(parameters('arcNodeResourceIds1')[copyIndex()],'/')),'- Key Vault Secrets User')]"
              }
            }
          ]
        },
        "parameters": { "arcNodeResourceIds1": { "value": "[parameters('arcNodeResourceIds')]" } }
      }
    },
    "ArcMachineInfraVMRoleAssignment": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "AzureStackHCIConnectedInfraVMs-RoleAssignment",
      "subscriptionId": "[subscription().subscriptionId]",
      "resourceGroup": "[resourceGroup().name]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "parameters": { "arcNodeResourceIds1": { "type": "array" } },
          "variables": {},
          "resources": [
            {
              "copy": { "name": "IfraVMroleAssignmentCopy", "count": "[length(parameters('arcNodeResourceIds1'))]" },
              "type": "Microsoft.Authorization/roleAssignments",
              "apiVersion": "2022-04-01",
              "name": "[guid(concat('INFRAVM-RoleAssign', parameters('arcNodeResourceIds1')[copyIndex()]))]",
              "properties": {
                "mode": "Incremental",
                "roleDefinitionId": "[concat(subscription().id, '/providers/Microsoft.Authorization/roleDefinitions/', 'c99c945f8bd14fb1a90301460aae6068')]",
                "principalId": "[reference(parameters('arcNodeResourceIds1')[copyIndex()], '2023-10-03-preview', 'full').identity.principalId]",
                "scope": "[resourceGroup().id]",
                "description": "[concat(substring(parameters('arcNodeResourceIds1')[copyIndex()],lastIndexOf(parameters('arcNodeResourceIds1')[copyIndex()],'/')),'- Azure Stack HCI Connected InfraVMs')]"
              }
            }
          ]
        },
        "parameters": { "arcNodeResourceIds1": { "value": "[parameters('arcNodeResourceIds')]" } }
      }
    },
    "StorageAccountConfigurations": {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2023-01-01",
      "name": "[parameters('diagnosticStorageAccountName')]",
      "location": "[parameters('location')]",
      "condition": "[parameters('createNewKeyVault')]",
      "sku": { "name": "[parameters('storageAccountType')]", "tier": "Standard" },
      "kind": "StorageV2",
      "properties": {
        "publicNetworkAccess": "Disabled",
        "allowSharedKeyAccess": false,
        "supportsHttpsTrafficOnly": true,
        "minimumTlsVersion": "TLS1_2",
        "networkAcls": { "defaultAction": "Deny" }
      }
    },
    "KVConfigurations": {
      "type": "Microsoft.KeyVault/vaults",
      "apiVersion": "2021-06-01-preview",
      "name": "[parameters('keyVaultName')]",
      "location": "[parameters('location')]",
      "condition": "[parameters('createNewKeyVault')]",
      "dependsOn": [
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('clusterWitnessStorageAccountName'))]",
        "[resourceId('Microsoft.Storage/storageAccounts', parameters('diagnosticStorageAccountName'))]"
      ],
      "properties": {
        "enabledForDeployment": true,
        "enabledForTemplateDeployment": true,
        "enabledForDiskEncryption": true,
        "enableSoftDelete": false,
        "softDeleteRetentionInDays": "[parameters('softDeleteRetentionDays')]",
        "enableRbacAuthorization": true,
        "publicNetworkAccess": "Enabled",
        "accessPolicies": [],
        "tenantId": "[parameters('tenantId')]",
        "sku": { "name": "standard", "family": "A" }
      }
    },
    "KVDiagnosticsConfig": {
      "type": "Microsoft.KeyVault/vaults/providers/diagnosticsettings",
      "name": "[concat(parameters('keyVaultName'), '/Microsoft.Insights/service')]",
      "apiVersion": "2016-09-01",
      "Location": "[resourceGroup().location]",
      "condition": "[parameters('createNewKeyVault')]",
      "dependsOn": [
        "[concat('Microsoft.KeyVault/vaults/', parameters('keyVaultName'))]",
        "[concat('Microsoft.Storage/storageAccounts/', parameters('diagnosticStorageAccountName'))]"
      ],
      "properties": {
        "storageAccountId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('diagnosticStorageAccountName'))]",
        "logs": [
          {
            "category": "AuditEvent",
            "enabled": true,
            "retentionPolicy": { "enabled": true, "days": "[parameters('LogsRetentionInDays')]" }
          }
        ]
      }
    },
    "nodeNameValidation": {
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2021-04-01",
      "name": "[if(contains(variables('isNodeNameValid'), 'false'), '##ClusterNameIsSameAsNodeName##', 'NodeNameIsValid')]",
      "properties": {
        "mode": "Incremental",
        "template": {
          "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
          "contentVersion": "1.0.0.0",
          "resources": []
        }
      }
    },
    "HCICluster": {
      "condition": "[equals(parameters('deploymentMode'), 'Validate')]",
      "type": "Microsoft.AzureStackHCI/clusters",
      "apiVersion": "2026-04-01-preview",
      "name": "[parameters('clusterName')]",
      "dependsOn": [
        "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]",
        "edgeDevices",
        "nodeNameValidation"
      ],
      "identity": { "type": "SystemAssigned" },
      "location": "[parameters('location')]",
      "properties": {}
    },
    "KVDomainAdminSecret": {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2021-06-01-preview",
      "name": "[concat(parameters('keyVaultName'), '/', variables('domainAdminSecretName'))]",
      "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ],
      "location": "[parameters('location')]",
      "scale": null,
      "properties": {
        "contentType": "Secret",
        "value": "[variables('domainAdminSecretValueVar')]",
        "attributes": { "enabled": true }
      }
    },
    "KVLocalAdminSecret": {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2021-06-01-preview",
      "name": "[concat(parameters('keyVaultName'), '/', variables('LocalAdminCredentialSecretName'))]",
      "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ],
      "location": "[parameters('location')]",
      "scale": null,
      "properties": {
        "contentType": "Secret",
        "value": "[variables('localAdminSecretValue')]",
        "attributes": { "enabled": true }
      }
    },
    "KVWitnessSecret": {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2021-06-01-preview",
      "name": "[concat(parameters('keyVaultName'), '/', variables('storageWitnessSecretName'))]",
      "condition": "[not(equals(parameters('witnessType'), 'No Witness'))]",
      "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ],
      "location": "[parameters('location')]",
      "scale": null,
      "properties": {
        "contentType": "Secret",
        "value": "[base64(listKeys(variables('CloudWithnessStorageAccountIdVar'), '2019-04-01').keys[0].value)]",
        "attributes": { "enabled": true }
      }
    },
    "KVPartnerCreds": {
      "type": "Microsoft.KeyVault/vaults/secrets",
      "apiVersion": "2021-06-01-preview",
      "name": "[concat(parameters('keyVaultName'), '/', parameters('partnerCredentialList')[copyIndex()].secretName)]",
      "dependsOn": [ "[resourceId('Microsoft.KeyVault/vaults', parameters('keyVaultName'))]" ],
      "location": "[parameters('location')]",
      "condition": "[not(empty(parameters('partnerCredentialList')))]",
      "copy": { "name": "partnerCredsLoop", "count": "[length(parameters('partnerCredentialList'))]" },
      "properties": {
        "contentType": "Secret",
        "value": "[base64(parameters('partnerCredentialList')[copyIndex()].secretValue)]",
        "attributes": { "enabled": true }
      }
    },
    "DeploymentSettings": {
      "type": "microsoft.azurestackhci/clusters/deploymentSettings",
      "apiVersion": "2026-04-01-preview",
      "name": "[format('{0}/default', parameters('clusterName'))]",
      "dependsOn": [ "[resourceId('Microsoft.AzureStackHCI/clusters', parameters('clusterName'))]" ],
      "properties": {
        "arcNodeResourceIds": "[parameters('arcNodeResourceIds')]",
        "deploymentMode": "[parameters('deploymentMode')]",
        "deploymentConfiguration": {
          "version": "10.0.0.0",
          "scaleUnits": [
            {
              "deploymentData": {
                "securitySettings": {
                  "hvciProtection": true,
                  "drtmProtection": true,
                  "driftControlEnforced": "[parameters('driftControlEnforced')]",
                  "credentialGuardEnforced": "[parameters('credentialGuardEnforced')]",
                  "smbSigningEnforced": "[parameters('smbSigningEnforced')]",
                  "smbClusterEncryption": "[parameters('smbClusterEncryption')]",
                  "sideChannelMitigationEnforced": true,
                  "bitlockerBootVolume": "[parameters('bitlockerBootVolume')]",
                  "bitlockerDataVolumes": "[parameters('bitlockerDataVolumes')]",
                  "wdacEnforced": "[parameters('wdacEnforced')]"
                },
                "observability": {
                  "streamingDataClient": "[parameters('streamingDataClient')]",
                  "euLocation": "[parameters('euLocation')]",
                  "episodicDataUpload": "[parameters('episodicDataUpload')]"
                },
                "cluster": {
                  "name": "[parameters('clusterName')]",
                  "witnessType": "[variables('witnessTypeVar')]",
                  "witnessPath": "",
                  "cloudAccountName": "[variables('clusterWitnessStorageAccountNameVar')]",
                  "azureServiceEndpoint": "[variables('AzureServiceEndpointVar')]"
                },
                "storage": {
                  "configurationMode": "[parameters('configurationMode')]",
                  "storageType": "SAN",
                  "san": {
                    "infraVolLunId": "[parameters('infraVolLunId')]",
                    "infraPerfLunId": "[parameters('infraPerfLunId')]"
                  }
                },
                "namingPrefix": "[parameters('namingPrefix')]",
                "domainFqdn": "[parameters('domainFqdn')]",
                "infrastructureNetwork": [
                  {
                    "subnetMask": "[parameters('subnetMask')]",
                    "gateway": "[parameters('defaultGateway')]",
                    "ipPools": [
                      {
                        "startingAddress": "[parameters('startingIPAddress')]",
                        "endingAddress": "[parameters('endingIPAddress')]"
                      }
                    ],
                    "dnsServers": "[parameters('dnsServers')]",
                    "useDhcp": "[parameters('useDhcp')]"
                  }
                ],
                "physicalNodes": "[parameters('physicalNodesSettings')]",
                "hostNetwork": {
                  "intents": "[parameters('intentList')]",
                  "sanNetworks": "[parameters('sanNetworkList')]",
                  "storageConnectivitySwitchless": "[parameters('storageConnectivitySwitchless')]"
                },
                "adouPath": "[parameters('adouPath')]",
                "secrets": "[variables('deploymentSecretsList')]",
                "optionalServices": { "customLocation": "[parameters('customLocation')]" }
              },
              "sbePartnerInfo": {
                "sbeDeploymentInfo": {
                  "version": "[parameters('sbeVersion')]",
                  "family": "[parameters('sbeFamily')]",
                  "publisher": "[parameters('sbePublisher')]",
                  "sbeManifestSource": "[parameters('sbeManifestSource')]",
                  "sbeManifestCreationDate": "[if(not(empty(parameters('sbeManifestCreationDate'))), parameters('sbeManifestCreationDate'), json('null'))]"
                },
                "partnerProperties": "[parameters('partnerProperties')]",
                "credentialList": "[variables('answerfileSBESecrets')]"
              }
            }
          ]
        }
      }
    }
  }
}