Azure Bicep files configuration TL;DR

This guide provides a deep dive into the specific configuration options available for your Azure Bot infrastructure. The settings are categorized by resource type to help you understand the impact of modifying the azurebot.bicep or the azure.parameters.json file.

🖥️ App Service & Compute Options

The App Service Plan defines the “hardware” and cost of your bot’s hosting. In your parameters, this is controlled by webAppSKU.

SKU Tier	Performance Level	Best For…	Key Features
B1	1 vCPU, 1.75GB RAM	Development / MVP	Custom domains, SSL, basic scaling, allowing CMK.
S1	1 vCPU, 3.5GB RAM	Small Production	Auto-scaling, 10 staging slots, daily backups.
P1v3	2 vCPUs, 8GB RAM	High Traffic	Faster processors (v3), higher memory, scale to 30 units.
F1	Shared CPU	Sandbox	Free tier. Strictly for learning; no custom domains or SSL.

🔐 Security & Network Configuration

The template enforces a strict “Service Tag” firewall. These settings ensure your bot is not accessible to the general public, only to the Azure Bot Service itself.

Configuration	Setting in Bicep	Effect
HTTPS Only	`httpsOnly: true`	Redirects all unencrypted traffic to secure `https`.
TLS Version	`minTlsVersion: '1.2'`	Enforces modern encryption (TLS 1.2+).
Firewall Rule 1	`AllowBotService`	Allows traffic from the `AzureBotService` service tag.
Firewall Rule 2	`Deny all`	Blocks any other request from the public internet.
Managed Identity	`identity: 'SystemAssigned'`	Allows the app to talk to Key Vault without a hardcoded password.

📦 Key Vault & Secrets

The Key Vault stores the “brain” of your bot’s identity. These settings protect against accidental deletion and data breaches.

Feature	Status	User Impact
Soft Delete	`Enabled`	If deleted, the vault can be recovered for up to 7 days.
Purge Protection	`Enabled`	Prevents the vault from being permanently deleted until the 7-day period expires.
Encryption	`RSA 2048`	Creates a standard cryptographic key for the app to use for signing or encrypting data.
Access Policy	`kvAccess`	Specifically grants your Bot’s Identity permission to `Get` secrets and `Wrap` keys.

📊 Monitoring & Logging (Log Analytics)

Everything your bot does is tracked in Log Analytics. These settings determine how long logs stay and what is captured.

Log Category	Description	Why it matters
AppServiceHTTPLogs	Incoming/Outgoing Web Requests	Essential for debugging connection issues (401/403 errors).
AppServiceAppLogs	`console.log` / Application output	Shows your actual bot logic errors and stack traces.
Retention	`30 Days`	Sets how long your data is stored before being deleted (lower = cheaper).
App Insights	`Application_Type: 'web'`	Provides a “Map” of your bot’s performance and dependencies.

🤖 Bot Registration (Module)

The azurebot.bicep module handles the identity that users interact with on platforms like Teams or Slack.

Parameter	Source	Description
`botDisplayName`	`azure.parameters.json`	The public name users see (e.g., “HR Helper Bot”).
`botAppDomain`	Generated Output	Automatically maps your bot’s identity to its web URL.
`botAadAppClientId`	`${{BOT_ID}}`	The unique ID that tells Microsoft which bot identity is yours.

Summary of Placeholders

When using your azure.parameters.json, ensure the following placeholders are handled by your deployment script:

${{RESOURCE_SUFFIX}}: Used to ensure global uniqueness (e.g., prod01).
${{BOT_ID}}: Your Microsoft App ID.
${{SECRET_BOT_PASSWORD}}: Your Microsoft App Secret (Securely stored in Key Vault).

Would you like me to create an Azure CLI script that specifically validates your Key Vault permissions once the deployment is finished?