# Azure Bicep files configuration TL;DR

This guide provides a deep dive into the specific configuration options available for your Azure Bot infrastructure. The settings are categorized by resource type to help you understand the impact of modifying the `azurebot.bicep` or the `azure.parameters.json` file.

---

## 🖥️ App Service & Compute Options

The **App Service Plan** defines the "hardware" and cost of your bot's hosting. In your parameters, this is controlled by `webAppSKU`.

| **SKU Tier** | **Performance Level** | **Best For...**   | **Key Features**                                                |
| ------------ | --------------------- | ----------------- | --------------------------------------------------------------- |
| **B1**       | 1 vCPU, 1.75GB RAM    | Development / MVP | Custom domains, SSL, basic scaling, allowing CMK.               |
| **S1**       | 1 vCPU, 3.5GB RAM     | Small Production  | Auto-scaling, 10 staging slots, daily backups.                  |
| **P1v3**     | 2 vCPUs, 8GB RAM      | High Traffic      | Faster processors (v3), higher memory, scale to 30 units.       |
| **F1**       | Shared CPU            | Sandbox           | **Free tier.** Strictly for learning; no custom domains or SSL. |

---

## 🔐 Security & Network Configuration

The template enforces a strict "Service Tag" firewall. These settings ensure your bot is not accessible to the general public, only to the Azure Bot Service itself.

| **Configuration**    | **Setting in Bicep**         | **Effect**                                                        |
| -------------------- | ---------------------------- | ----------------------------------------------------------------- |
| **HTTPS Only**       | `httpsOnly: true`            | Redirects all unencrypted traffic to secure `https`.              |
| **TLS Version**      | `minTlsVersion: '1.2'`       | Enforces modern encryption (TLS 1.2+).                            |
| **Firewall Rule 1**  | `AllowBotService`            | Allows traffic from the `AzureBotService` service tag.            |
| **Firewall Rule 2**  | `Deny all`                   | Blocks **any** other request from the public internet.            |
| **Managed Identity** | `identity: 'SystemAssigned'` | Allows the app to talk to Key Vault without a hardcoded password. |

---

## 📦 Key Vault & Secrets

The Key Vault stores the "brain" of your bot's identity. These settings protect against accidental deletion and data breaches.

| **Feature**          | **Status** | **User Impact**                                                                         |
| -------------------- | ---------- | --------------------------------------------------------------------------------------- |
| **Soft Delete**      | `Enabled`  | If deleted, the vault can be recovered for up to 7 days.                                |
| **Purge Protection** | `Enabled`  | Prevents the vault from being permanently deleted until the 7-day period expires.       |
| **Encryption**       | `RSA 2048` | Creates a standard cryptographic key for the app to use for signing or encrypting data. |
| **Access Policy**    | `kvAccess` | Specifically grants your Bot's Identity permission to `Get` secrets and `Wrap` keys.    |

---

## 📊 Monitoring & Logging (Log Analytics)

Everything your bot does is tracked in **Log Analytics**. These settings determine how long logs stay and what is captured.

| **Log Category**       | **Description**                    | **Why it matters**                                                        |
| ---------------------- | ---------------------------------- | ------------------------------------------------------------------------- |
| **AppServiceHTTPLogs** | Incoming/Outgoing Web Requests     | Essential for debugging connection issues (401/403 errors).               |
| **AppServiceAppLogs**  | `console.log` / Application output | Shows your actual bot logic errors and stack traces.                      |
| **Retention**          | `30 Days`                          | Sets how long your data is stored before being deleted (lower = cheaper). |
| **App Insights**       | `Application_Type: 'web'`          | Provides a "Map" of your bot's performance and dependencies.              |

---

## 🤖 Bot Registration (Module)

The `azurebot.bicep` module handles the identity that users interact with on platforms like Teams or Slack.

| **Parameter**       | **Source**              | **Description**                                                 |
| ------------------- | ----------------------- | --------------------------------------------------------------- |
| `botDisplayName`    | `azure.parameters.json` | The public name users see (e.g., "HR Helper Bot").              |
| `botAppDomain`      | Generated Output        | Automatically maps your bot's identity to its web URL.          |
| `botAadAppClientId` | `${{BOT_ID}}`           | The unique ID that tells Microsoft which bot identity is yours. |

---

## Summary of Placeholders

When using your `azure.parameters.json`, ensure the following placeholders are handled by your deployment script:

- **`${{RESOURCE_SUFFIX}}`**: Used to ensure global uniqueness (e.g., `prod01`).
- **`${{BOT_ID}}`**: Your Microsoft App ID.
- **`${{SECRET_BOT_PASSWORD}}`**: Your Microsoft App Secret (Securely stored in Key Vault).

Would you like me to create an **Azure CLI script** that specifically validates your Key Vault permissions once the deployment is finished?