### Policy Assignments Dependencies Example

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Provides an example of setting up dependencies for policy assignments. This ensures that policy assignments are created in the correct order by referencing computed/known values after apply. Use this when unknown values and `depends_on` are not supported.

```hcl
policy_assignments_dependencies = [
  module.dependency_example1.output,
  module.dependency_example2.output,
]
```

--------------------------------

### Pinning AVM Module Version in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

When using AVM modules, it's crucial to pin to a specific version for predictable deployments. This example shows how to specify the version.

```terraform
version = "1.2.3"
```

--------------------------------

### Terraform Provider Version Constraint

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

When configuring providers for AVM modules, use pessimistic version constraints to ensure compatibility and avoid unexpected upgrades. This example uses a '~> 1.0' constraint.

```terraform
version = "~> 1.0"
```

--------------------------------

### Deploy ALZ Reference Architecture with Terraform

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/default/README.md

This configuration deploys the ALZ reference architecture. It includes setting up the ALZ provider with library overrides and defining the main ALZ architecture module. Ensure the 'azapi' provider is configured to access tenant information.

```hcl
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

# Include the additional policies and override archetypes
provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      path = "platform/alz",
      ref  = "2026.04.2"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz"
  location           = "northeurope"
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
}
```

--------------------------------

### Configure ALZ Provider with Custom Libraries

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Configure the ALZ provider to reference both a platform library and a custom local library. Ensure the custom library path is correctly specified.

```hcl
provider "alz" {
  library_references = [
    {
      "path" : "platform/alz",
      "ref" : "2026.01.3"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}
```

--------------------------------

### Default Tags for Resource Deployment

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/amba/README.md

Provides the default map of tags applied to resources deployed by the module. This includes a tag to indicate deployment by AMBA.

```json
{
  "_deployed_by_amba": "True"
}
```

--------------------------------

### Terraform Module Source from GitHub

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

This snippet illustrates how to specify the source for an AVM module hosted on GitHub, including the organization, repository structure, and type.

```terraform
https://github.com/Azure/terraform-azurerm-avm-{type}-{service}-{resource}
```

--------------------------------

### Configure Schema Validation for Resource Types

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Define which resource types should have schema validation enabled. Defaults to true for all types.

```hcl
object({
    hierarchy_settings     = optional(bool, true)
    management_groups      = optional(bool, true)
    policy_assignments     = optional(bool, true)
    policy_definitions     = optional(bool, true)
    policy_set_definitions = optional(bool, true)
    role_assignments       = optional(bool, true)
    role_definitions       = optional(bool, true)
  })
```

--------------------------------

### Terraform Versions API for Modules

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

This URL format can be used to query the Terraform registry's Versions API for specific AVM modules, allowing programmatic access to version information.

```terraform
https://registry.terraform.io/v1/modules/Azure/{module}/[azurerm|azure]/versions
```

--------------------------------

### Terraform Configuration for ALZ and AMBA Integration

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/amba/README.md

This configuration sets up the ALZ provider with custom library references for ALZ and AMBA, and configures the azurerm provider. It also defines local variables and instantiates the AMBA and ALZ modules with specific configurations and default policy values.

```hcl
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

# Include the additional policies and override archetypes
provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      "path" : "platform/alz",
      "ref" : "2026.01.3"
    },
    {
      "path" : "platform/amba",
      "ref" : "2025.05.0"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

provider "azurerm" {
  alias           = "management"
  subscription_id = var.management_subscription_id != "" ? var.management_subscription_id : data.azapi_client_config.current.subscription_id
  features {}
}

locals {
  root_management_group_name = keys(module.alz_architecture.management_group_resource_ids)[0]
}

module "amba_alz" {
  source  = "Azure/avm-ptn-monitoring-amba-alz/azurerm"
  version = "0.1.1"
  providers = {
    azurerm = azurerm.management
  }
  count = var.bring_your_own_user_assigned_managed_identity ? 0 : 1

  location                            = var.location
  root_management_group_name          = local.root_management_group_name
  resource_group_name                 = var.resource_group_name
  user_assigned_managed_identity_name = var.user_assigned_managed_identity_name
}

module "alz_architecture" {
  source  = "Azure/avm-ptn-alz/azurerm"
  version = "0.12.0"

  architecture_name  = "alz-amba"
  location           = var.location
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_default_values = {
    amba_alz_management_subscription_id            = jsonencode({ value = var.management_subscription_id != "" ? var.management_subscription_id : data.azapi_client_config.current.subscription_id })
    amba_alz_resource_group_location               = jsonencode({ value = var.location })
    amba_alz_resource_group_name                   = jsonencode({ value = var.resource_group_name })
    amba_alz_resource_group_tags                   = jsonencode({ value = var.tags })
    amba_alz_user_assigned_managed_identity_name   = jsonencode({ value = var.user_assigned_managed_identity_name })
    amba_alz_byo_user_assigned_managed_identity_id = jsonencode({ value = var.bring_your_own_user_assigned_managed_identity_resource_id })
    amba_alz_disable_tag_name                      = jsonencode({ value = var.amba_disable_tag_name })
    amba_alz_disable_tag_values                    = jsonencode({ value = var.amba_disable_tag_values })
    amba_alz_action_group_email                    = jsonencode({ value = var.action_group_email })
    amba_alz_arm_role_id                           = jsonencode({ value = var.action_group_arm_role_id })
    amba_alz_webhook_service_uri                   = jsonencode({ value = var.webhook_service_uri })
    amba_alz_event_hub_resource_id                 = jsonencode({ value = var.event_hub_resource_id })
    amba_alz_function_resource_id                  = jsonencode({ value = var.function_resource_id })
    amba_alz_function_trigger_url                  = jsonencode({ value = var.function_trigger_uri })
    amba_alz_logicapp_resource_id                  = jsonencode({ value = var.logic_app_resource_id })
    amba_alz_logicapp_callback_url                 = jsonencode({ value = var.logic_app_callback_url })
    amba_alz_byo_alert_processing_rule             = jsonencode({ value = var.bring_your_own_alert_processing_rule_resource_id })
    amba_alz_byo_action_group                      = jsonencode({ value = var.bring_your_own_action_group_resource_id })
  }
}
```

--------------------------------

### Define Local Variables for Resource Configuration

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Define local variables to centralize configuration values such as location, names, and resource IDs. This improves readability and maintainability.

```hcl
locals {
  location                              = "swedencentral"
  maintenance_configuration_name        = "ring1"
  maintenance_configuration_resource_id = provider::azapi::resource_group_resource_id(data.azurerm_client_config.current.subscription_id, local.resource_group_name, "Microsoft.Maintenance/maintenanceConfigurations", [local.maintenance_configuration_name])
  resource_group_name                   = "rg-update-manager"
  user_assigned_identity_name           = "uami-policy"
  user_assigned_identity_resource_id    = provider::azapi::resource_group_resource_id(data.azurerm_client_config.current.subscription_id, local.resource_group_name, "Microsoft.ManagedIdentity/userAssignedIdentities", [local.user_assigned_identity_name])
}
```

--------------------------------

### Define Management Group Dependencies

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Specify dependencies for management group creation to ensure they are created in the correct order. This is necessary because the ALZ provider does not support `depends_on` or unknown values directly.

```hcl
management_group_dependencies = [
  module.dependency_example1.output,
  module.dependency_example2.output,
]
```

--------------------------------

### Terraform Configuration for ALZ and Management Modules

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/privatednszones/README.md

This Terraform configuration sets up the ALZ and management modules, including the deployment of private DNS zones. It specifies provider configurations for 'alz' and 'azurerm', defines local variables for location and resource group, and configures policy assignments and default values.

```hcl
provider "alz" {
  library_references = [{
    path = "platform/alz"
    ref  = "2026.01.3"
  }]
}

provider "azurerm" {
  features {}
}


data "azapi_client_config" "current" {}

locals {
  location            = "swedencentral"
  resource_group_name = "rg-private-dns-${var.random_suffix}"
}

module "private_dns_zones" {
  source  = "Azure/avm-ptn-network-private-link-private-dns-zones/azurerm"
  version = "0.7.0"

  location            = local.location
  resource_group_name = local.resource_group_name
}

module "alz" {
  source = "../../"

  architecture_name  = "alz"
  location           = local.location
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_assignments_dependencies = [
    module.private_dns_zones.private_dns_zone_resource_ids,
  ]
  policy_assignments_to_modify = {
    connectivity = {
      policy_assignments = {
        # As we don't have a DDOS protection plan, we need to disable this policy
        # to prevent a modify action from failing.
        Enable-DDoS-VNET = {
          enforcement_mode = "DoNotEnforce"
        }
      }
    }
  }
  policy_default_values = {
    private_dns_zone_subscription_id     = jsonencode({ value = data.azapi_client_config.current.subscription_id })
    private_dns_zone_region              = jsonencode({ value = local.location })
    private_dns_zone_resource_group_name = jsonencode({ value = local.resource_group_name })
  }
}
```

--------------------------------

### Terraform Module Source from Registry

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

This snippet shows the format for referencing an AVM module directly from the Terraform Registry, including the module name and provider.

```terraform
https://registry.terraform.io/modules/Azure/{module}/azurerm/latest
```

--------------------------------

### Configure Timeouts for Azure Resources

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Use this block to define custom timeouts for resource operations like creation and deletion. The time durations are parsed using Go's time.ParseDuration function. Defaults are provided for each resource type, with specific overrides for policy assignments.

```hcl
object({
    management_group = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
    role_definition = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
    role_assignment = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
    policy_definition = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
    policy_set_definition = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
    policy_assignment = optional(object({
      create = optional(string, "20m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "5m")
      }), {}
    )
    policy_role_assignment = optional(object({
      create = optional(string, "60m")
      delete = optional(string, "5m")
      update = optional(string, "5m")
      read   = optional(string, "60m")
      }), {}
    )
  })
```

--------------------------------

### ALZ and Management Module Configuration

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/management/README.md

This snippet shows the Terraform configuration for deploying the ALZ reference architecture and the ALZ management module. It includes provider configurations, local variables for resource naming and location, and module definitions for both 'management' and 'alz'. The 'alz' module's policy assignments and default values are also configured here.

```hcl
provider "alz" {
  library_references = [{
    path = "platform/alz"
    ref  = "2026.01.3"
  }]
}

provider "azurerm" {
  features {}
}


data "azapi_client_config" "current" {}

locals {
  automation_account_name      = "aa-${var.random_suffix}"
  location                     = "swedencentral"
  log_analytics_workspace_name = "law-${var.random_suffix}"
  resource_group_name          = "rg-alz-management-${var.random_suffix}"
  uami_name                    = "uami-ama"
}

module "management" {
  source  = "Azure/avm-ptn-alz-management/azurerm"
  version = "0.6.0"

  automation_account_name      = local.automation_account_name
  location                     = local.location
  log_analytics_workspace_name = local.log_analytics_workspace_name
  resource_group_name          = local.resource_group_name
}

module "alz" {
  source = "../../"

  architecture_name  = "alz"
  location           = local.location
  parent_resource_id = data.azapi_client_config.current.tenant_id
  policy_assignments_dependencies = [
    module.management.data_collection_rule_ids,
    module.management.resource_id,
    module.management.user_assigned_identity_ids,
  ]
  policy_assignments_to_modify = {
    connectivity = {
      policy_assignments = {
        # As we don't have a DDOS protection plan, we need to disable this policy
        # to prevent a modify action from failing.
        Enable-DDoS-VNET = {
          enforcement_mode = "DoNotEnforce"
        }
      }
    }
  }
  policy_default_values = {
    ama_change_tracking_data_collection_rule_id = jsonencode({ value = provider::azapi::resource_group_resource_id(data.azapi_client_config.current.subscription_id, local.resource_group_name, "Microsoft.Insights/dataCollectionRules", ["dcr-change-tracking"]) })
    ama_mdfc_sql_data_collection_rule_id        = jsonencode({ value = provider::azapi::resource_group_resource_id(data.azapi_client_config.current.subscription_id, local.resource_group_name, "Microsoft.Insights/dataCollectionRules", ["dcr-defender-sql"]) })
    ama_vm_insights_data_collection_rule_id     = jsonencode({ value = provider::azapi::resource_group_resource_id(data.azapi_client_config.current.subscription_id, local.resource_group_name, "Microsoft.Insights/dataCollectionRules", ["dcr-vm-insights"]) })
    ama_user_assigned_managed_identity_id       = jsonencode({ value = provider::azapi::resource_group_resource_id(data.azapi_client_config.current.subscription_id, local.resource_group_name, "Microsoft.ManagedIdentity/userAssignedIdentities", [local.uami_name]) })
    ama_user_assigned_managed_identity_name     = jsonencode({ value = local.uami_name })
    log_analytics_workspace_id                  = jsonencode({ value = provider::azapi::resource_group_resource_id(data.azapi_client_config.current.subscription_id, local.resource_group_name, "Microsoft.OperationalInsights/workspaces", [local.log_analytics_workspace_name]) })
  }
}
```

--------------------------------

### Configure Policy Role Assignment Dependencies

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Use this variable to ensure policy role assignments are created in the correct order by providing computed resource IDs. This is essential when using the ALZ provider which does not support unknown values or 'depends_on'.

```hcl
policy_role_assignments_dependencies = [
  module.dependency_example1.output,
  module.dependency_example2.output,
]
```

--------------------------------

### Terraform Configuration for Management Group Placement

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/specify-parent-management-group-on-destroy/README.md

This HCL code configures Terraform to deploy resources to a specified management group and defines the behavior for moving subscriptions back to that group on destroy. It includes data sources for client configuration, provider settings for ALZ, local variables for management group IDs, and an azapi_resource to create the management group. The alz_architecture module is then configured with parent_resource_id and subscription_placement_destroy_behavior.

```hcl
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

# Include the additional policies and override archetypes
provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      path = "platform/alz",
      ref  = "2026.01.3"
    },
    {
      custom_url = "${path.module}/lib"
    }
  ]
}

locals {
  intermediate_root_management_group_id = [for management_group in jsondecode(file("${path.module}/lib/alz.alz_architecture_definition.json")).management_groups : management_group.id if management_group.parent_id == null][0]
  parent_management_group_id            = "alz-test-mg-${var.random_suffix}"
}

resource "azapi_resource" "example" {
  name      = local.parent_management_group_id
  parent_id = "/"
  type      = "Microsoft.Management/managementGroups@2023-04-01"
  body = {
    properties = {
      details = {
        parent = {
          id = "/providers/Microsoft.Management/managementGroups/${data.azapi_client_config.current.tenant_id}"
        }
      }
      displayName = "ALZ Test MG ${var.random_suffix}"
    }
  }
  response_export_values = []
  retry = {
    error_message_regex = [
      "AuthorizationFailed", # Avoids a eventual consistency issue where a recently created management group is not yet available for a GET operation.
      "Permission to Microsoft.Management/managementGroups on resources of type 'Write' is required on the management group or its ancestors."
    ]
  }

  timeouts {
    create = "60m"
    delete = "5m"
    read   = "60m"
    update = "5m"
  }
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz"
  location           = "northeurope"
  parent_resource_id = azapi_resource.example.name
  enable_telemetry   = var.enable_telemetry
  subscription_placement = {
    test = {
      subscription_id       = data.azapi_client_config.current.subscription_id
      management_group_name = local.intermediate_root_management_group_id
    }
  }
  subscription_placement_destroy_behavior = "parent"
}

```

--------------------------------

### Use AzAPI Provider for Resource ID

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/_header.md

This snippet demonstrates how to use the `azapi_resource_group_resource_id` function to construct a resource ID. This is useful when passing dynamic resource IDs as parameters to module inputs, especially when dealing with unknown values.

```terraform
locals {
  subscription_id     = data.azapi_client_config.current.subscription_id
  resource_group_name = "rg1"
  resource_type       = "Microsoft.Network/virtualNetworks"
  resource_names      = ["vnet1"]
  my_resource_id = provider::azapi::resource_group_resource_id(
    data.azapi_client_config.current.subscription_id,
    local.resource_group_name,
    local.resource_type,
    local.resource_names
  )
}

module "example" {
  source = "Azure/terraform-azurerm-avm-ptn-alz/azurerm"

  policy_assignments_to_modify = {
    alzroot = {
      policy_assignments = {
        mypolicy = {
          parameters = {
            parameterName = jsonencode({ value = local.my_resource_id })
          }
        }
      }
    }
  }
}
```

--------------------------------

### Define Resource Types with API Versions

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

This object allows customization of AzAPI resource types, including their API versions. It's useful for sovereign clouds or to address AzAPI casing inconsistencies. Modifying these defaults may lead to unexpected behavior.

```hcl
object({
    management_group              = optional(string, "Microsoft.Management/managementGroups@2023-04-01")
    management_group_settings     = optional(string, "Microsoft.Management/managementGroups/settings@2023-04-01")
    management_group_subscription = optional(string, "Microsoft.Management/managementGroups/subscriptions@2023-04-01")
    policy_assignment             = optional(string, "Microsoft.Authorization/policyAssignments@2024-04-01")
    policy_definition             = optional(string, "Microsoft.Authorization/policyDefinitions@2023-04-01")
    policy_set_definition         = optional(string, "Microsoft.Authorization/policySetDefinitions@2023-04-01")
    role_assignment               = optional(string, "Microsoft.Authorization/roleAssignments@2022-04-01")
    role_definition               = optional(string, "Microsoft.Authorization/roleDefinitions@2022-04-01")
    user_assigned_identity        = optional(string, "Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31")
  })
```

--------------------------------

### Assign Roles with ALZ Module

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/role-assignments/README.md

Use this configuration to assign built-in and custom roles to principals within management groups. Ensure the `pre.sh` script is executed beforehand and required providers are configured.

```hcl
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

# Include the additional policies and override archetypes
provider "alz" {
  library_references = [
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "test"
  location           = "northeurope"
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  management_group_role_assignments = {
    test1 = {
      principal_type             = var.principal_type
      role_definition_id_or_name = "Storage Blob Data Contributor"
      principal_id               = data.azapi_client_config.current.object_id
      management_group_name      = "${var.prefix}test1"
    }
    test2 = {
      principal_type             = var.principal_type
      role_definition_id_or_name = "Security-Operations (${var.prefix}test2)"
      principal_id               = data.azapi_client_config.current.object_id
      management_group_name      = "${var.prefix}test2"
    }
  }
}
```

--------------------------------

### Map Subscriptions to Management Groups

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Specify subscriptions and their target management groups. The key is arbitrary to prevent apply-time conflicts.

```hcl
map(object({
    subscription_id       = string
    management_group_name = string
  }))
```

--------------------------------

### ALZ Deployment with Intermediate Root Management Group

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/specify-intermediate-root-management-group-on-destroy/README.md

This HCL code configures the ALZ module to deploy to a specified intermediate root management group. It also sets up subscription placement and defines the destroy behavior to return subscriptions to the intermediate root.

```hcl
data "azapi_client_config" "current" {}

provider "alz" {
  library_overwrite_enabled = true
  library_references = [
    {
      path = "platform/alz"
      ref  = "2026.01.3"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

locals {
  intermediate_root_management_group_id = "${var.prefix}-alz"
  parent_management_group_id            = "${var.prefix}-alz-parent"
}

resource "azapi_resource" "parent" {
  name      = local.parent_management_group_id
  parent_id = "/"
  type      = "Microsoft.Management/managementGroups@2023-04-01"
  body = {
    properties = {
      details = {
        parent = {
          id = "/providers/Microsoft.Management/managementGroups/${data.azapi_client_config.current.tenant_id}"
        }
      }
      displayName = "ALZ Test MG ${var.prefix}"
    }
  }
  response_export_values = []
  retry = {
    error_message_regex = [
      "AuthorizationFailed", 
      "Permission to Microsoft.Management/managementGroups on resources of type 'Write' is required on the management group or its ancestors."
    ]
  }

  timeouts {
    create = "60m"
    delete = "5m"
    read   = "60m"
    update = "5m"
  }
}

resource "azapi_resource" "intermediate_root" {
  name      = local.intermediate_root_management_group_id
  parent_id = "/"
  type      = "Microsoft.Management/managementGroups@2023-04-01"
  body = {
    properties = {
      details = {
        parent = {
          id = azapi_resource.parent.id
        }
      }
      displayName = "${var.prefix} ALZ root"
    }
  }
  response_export_values = []
  retry = {
    error_message_regex = [
      "AuthorizationFailed", 
      "Permission to Microsoft.Management/managementGroups on resources of type 'Write' is required on the management group or its ancestors."
    ]
  }

  timeouts {
    create = "60m"
    delete = "5m"
    read   = "60m"
    update = "5m"
  }
}

resource "azapi_resource_action" "subscription_placement_create" {
  method                 = "PUT"
  resource_id            = "/providers/Microsoft.Management/managementGroups/${azapi_resource.intermediate_root.name}/subscriptions/${data.azapi_client_config.current.subscription_id}"
  type                   = "Microsoft.Management/managementGroups/subscriptions@2023-04-01"
  response_export_values = []
  when                   = "apply"
}

resource "azapi_resource_action" "subscription_placement_delete" {
  method                 = "PUT"
  resource_id            = "/providers/Microsoft.Management/managementGroups/${data.azapi_client_config.current.tenant_id}/subscriptions/${data.azapi_client_config.current.subscription_id}"
  type                   = "Microsoft.Management/managementGroups/subscriptions@2023-04-01"
  response_export_values = []
  when                   = "destroy"

  depends_on = [azapi_resource.intermediate_root]
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz"
  location           = "northeurope"
  parent_resource_id = azapi_resource.parent.name
  enable_telemetry   = var.enable_telemetry
  management_groups_dependencies = [
    azapi_resource_action.subscription_placement_create,
    azapi_resource_action.subscription_placement_delete,
  ]
  subscription_placement = {
    test = {
      subscription_id       = data.azapi_client_config.current.subscription_id
      management_group_name = "${var.prefix}-management"
    }
  }
  subscription_placement_destroy_behavior = "intermediate_root"
}

```

--------------------------------

### Retrieve Tenant ID using AzureRM Client Config

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Use the azurerm_client_config data source to retrieve the current tenant ID, which is often needed for parent resource configurations.

```hcl
# This allows us to get the tenant id
data "azurerm_client_config" "current" {}
```

--------------------------------

### Deploy ALZ Module with Policy Assignment Modifications

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Deploy the ALZ module, specifying a custom architecture, location, and parent resource ID. Crucially, it modifies existing policy assignments by providing new parameters and identity configurations.

```hcl
module "alz" {
  source = "../../"

  architecture_name  = "custom"
  location           = local.location
  parent_resource_id = data.azurerm_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_assignments_dependencies = [
    azurerm_user_assigned_identity.this.id
  ]
  policy_assignments_to_modify = {
    (var.prefix) = {
      policy_assignments = {
        Update-Ring1 = {
          parameters = {
            maintenanceConfigurationResourceId = jsonencode({ value = local.maintenance_configuration_resource_id })
            tagValues                          = jsonencode({ value = [{ key = "Update Manager Policy", value = "Ring1" }] })
            effect                             = jsonencode({ value = "DeployIfNotExists" })
          }
          identity     = "UserAssigned"
          identity_ids = [local.user_assigned_identity_resource_id]
        }
      }
    }
  }
}
```

--------------------------------

### Configure Non-Compliance Messages

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/non-compliance-messages/README.md

This snippet configures both a default non-compliance message for all policy assignments and specific messages for individual assignments, including per-policy-definition-reference messages within an initiative. It also shows how to set up substitution settings for enforcement modes at the provider level.

```HCL
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

provider "alz" {
  library_references = [
    {
      path = "platform/alz"
      ref  = "2026.04.2"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]

  # Optional settings for non-compliance messages at the provider level
  non_compliance_message_substitution_settings = {
    enforcement_mode_placeholder = "{enforcementMode}" # If you want a different placeholder, however, this may affect policies in the library that uses this placeholder.
    enforced_replacement         = "must"              # The word to replace the placeholder with when the policy is enforced
    not_enforced_replacement     = "should"            # The word to replace the placeholder with when the policy is not enforced
  }
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz_custom"
  location           = "northeurope"
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_assignment_non_compliance_message_settings = {
    default_message = "This resource {enforcementMode} be compliant with the assigned policy. Contact the cloud platform team for guidance."
    # merge_mode      = "prefer_existing"
  }
  policy_assignments_to_modify = {
    ("${var.prefix}-alz") = {
      policy_assignments = {
        Deploy-MDFC-Config-H224 = {
          non_compliance_messages = [
            {
              message = "Microsoft Defender for Cloud {enforcementMode} be configured for all subscriptions."
            },
            {
              message                        = "Defender for Servers {enforcementMode} be enabled on all subscriptions."
              policy_definition_reference_id = "defenderForVM"
            },
            {
              message                        = "Defender for Storage {enforcementMode} be enabled on all storage accounts."
              policy_definition_reference_id = "defenderForStorageAccountsV2"
            },
            {
              message                        = "Defender for SQL {enforcementMode} be enabled on all Azure SQL databases."
              policy_definition_reference_id = "defenderForSqlPaas"
            },
          ]
        }
      }
    }
  }
}

```

--------------------------------

### Override Policy Definition Parameter Metadata

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Use this list of objects to set the `assignPermissions` metadata property for policy definitions and parameters. This is useful for correcting policies that lack proper metadata, enabling the provider to generate correct policy role assignments.

```hcl
set(object({
    definition_name = string
    parameter_name  = string
  }))
```

--------------------------------

### Mapping Enable Telemetry in Terraform

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/AGENTS.md

To manage telemetry settings consistently across AVM modules, map the 'enable_telemetry' variable to a root variable. This ensures centralized control over telemetry.

```terraform
enable_telemetry = var.enable_telemetry
```

--------------------------------

### Configure Azure Maintenance Configuration

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Define an Azure maintenance configuration for managing guest patching. Specify the scope, reboot behavior, and schedule details.

```hcl
resource "azurerm_maintenance_configuration" "this" {
  location                 = azurerm_resource_group.this.location
  name                     = local.maintenance_configuration_name
  resource_group_name      = azurerm_resource_group.this.name
  scope                    = "InGuestPatch"
  in_guest_user_patch_mode = "User"

  install_patches {
    reboot = "IfRequired"

    windows {
      classifications_to_include = ["Critical", "Security", "Definition"]
    }
  }
  window {
    start_date_time = "2024-01-03 00:00"
    time_zone       = "GMT Standard Time"
    duration        = "03:55"
    recur_every     = "Week"
  }
}
```

--------------------------------

### Define Azure Resource Group

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Declare an Azure resource group to host other resources. Ensure the location and name are defined, typically using local variables.

```hcl
resource "azurerm_resource_group" "this" {
  location = local.location
  name     = local.resource_group_name
}
```

--------------------------------

### Default Tag Values for Disabling Monitoring

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/amba/README.md

Specifies the default tag name and values used to disable monitoring at the resource level. These are typically applied as resource tags.

```json
[
  "true",
  "Test",
  "Dev",
  "Sandbox"
]
```

--------------------------------

### Terraform HCL for Policy Default Values

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Defines a map of default values to apply to policy assignments. The key is the default name as defined in the library, and the value is a JSON object containing a single `value` attribute.

```hcl
map(string)
```

--------------------------------

### Policy Assignment Non-Compliance Message Settings

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Defines settings for default non-compliance messages on policy assignments. Use `default_message` for the message content and `merge_mode` to control how it interacts with existing messages. Defaults to `{}`.

```hcl
object({
    default_message = optional(string, "This resource {enforcementMode} be compliant with the assigned policy")
    merge_mode      = optional(string, "replace")
  })
```

--------------------------------

### Add Custom Tags to Telemetry Data

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Include additional custom tags in telemetry data. Serialize complex types like arrays or objects as JSON strings.

```hcl
telemetry_additional_content = {
  custom_tag_1 = "value1"
  custom_tag_2 = "value2"
  custom_array_tag = jsonencode(["value1", "value2"])
}
```

--------------------------------

### Restrict Role Assignments with Conditions

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Use this condition to restrict role assignments, preventing sensitive roles like Owner or Administrator from being assigned to unintended principals. This is applied within the `management_group_role_assignments` variable.

```text
"((!(ActionMatches{'Microsoft.Authorization/roleAssignments/write'}))OR(@Request[Microsoft.Authorization/roleAssignments:RoleDefinitionId]ForAnyOfAllValues:GuidNotEquals{8e3af657-a8ff-443c-a75c-2fe8c4bcb635, 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9, f58310d9-a9f6-439a-9e8d-f62e7b41a168}))AND((!(ActionMatches{'Microsoft.Authorization/roleAssignments/delete'}))OR(@Resource[Microsoft.Authorization/roleAssignments:RoleDefinitionId]ForAnyOfAllValues:GuidNotEquals{8e3af657-a8ff-443c-a75c-2fe8c4bcb635, 18d7d88d-d35e-4fb5-a5c3-7773c20a72d9, f58310d9-a9f6-439a-9e8d-f62e7b41a168}))"
```

--------------------------------

### Override Parent IDs for Resources

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

A map of parent ID overrides for resources with inconsistent casing in Azure. This prevents forced replacements due to casing differences.

```hcl
module "alz" {
  source = "Azure/terraform-azurerm-avm-ptn-alz/azurerm"

  # the key format is `management group id/policy assignment name`
  parent_id_overrides = {
    policy_definitions = {
      "alz/Deny-Classic-Resources" = "/providers/Microsoft.Management/managementgroups"
    }
  }
}
```

--------------------------------

### Configure not_scopes for Policy Assignment

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-not-scopes/README.md

Use the `not_scopes` argument within the `policy_assignments_to_modify` block to specify resource IDs that should be excluded from policy evaluation. This is useful for granular control over policy application.

```hcl
data "azapi_client_config" "current" {}

provider "alz" {
  library_references = [
    {
      path = "platform/alz"
      ref  = "2026.04.2"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz_custom"
  location           = "northeurope"
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_assignments_to_modify = {
    ("${var.prefix}-platform") = {
      policy_assignments = {
        Enforce-ASR = {
          not_scopes = [
            "/subscriptions/${data.azapi_client_config.current.subscription_id}",
          ]
        }
      }
    }
  }
}
```

--------------------------------

### Disable Policy Assignments in ALZ Module

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/disable-policy-assignment/README.md

Use the `policy_assignments_to_modify` variable to disable specific policy assignments by setting `creation_enabled = false`. This is useful for excluding policies not relevant to your environment, such as DDoS protection or private DNS zones.

```hcl
# This allows us to get the tenant id
data "azapi_client_config" "current" {}

provider "alz" {
  library_references = [
    {
      path = "platform/alz",
      ref  = "2026.01.3"
    },
    {
      custom_url = "${path.root}/lib"
    }
  ]
}

module "alz_architecture" {
  source = "../../"

  architecture_name  = "alz_custom"
  location           = "northeurope"
  parent_resource_id = data.azapi_client_config.current.tenant_id
  enable_telemetry   = var.enable_telemetry
  policy_assignments_to_modify = {
    ("${var.prefix}-connectivity") = {
      policy_assignments = {
        # Disable the DDoS protection policy assignment as we don't have a DDoS protection plan.
        Enable-DDoS-VNET = {
          creation_enabled = false
        }
      }
    }
    ("${var.prefix}-corp") = {
      policy_assignments = {
        # Disable the private DNS zones policy assignment as we don't have private DNS zones deployed.
        Deploy-Private-DNS-Zones = {
          creation_enabled = false
        }
      }
    }
    ("${var.prefix}-landingzones") = {
      policy_assignments = {
        # Disable the DDoS protection policy assignment as we don't have a DDoS protection plan.
        Enable-DDoS-VNET = {
          creation_enabled = false
        }
      }
    }
  }
}

```

--------------------------------

### Unset assignPermissions Metadata Property

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Use this to unset the `assignPermissions` metadata property for specific policy definition and parameter names. This is useful for correcting policies or preventing permissions for disabled policies.

```hcl
[
  {
    "definition_name": "f0fcf93c-c063-4071-9668-c47474bd3564",
    "parameter_name": "privateDnsZoneId"
  },
  {
    "definition_name": "f91991d1-5383-4c95-8ee5-5ac423dd8bb1",
    "parameter_name": "userAssignedIdentityResourceId"
  },
  {
    "definition_name": "fbc14a67-53e4-4932-abcc-2049c6706009",
    "parameter_name": "privateDnsZoneId"
  }
]
```

--------------------------------

### Terraform HCL for Policy Assignments to Modify

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/README.md

Defines a map of policy assignment objects to modify the ALZ architecture. Specify only the properties you want to change. The key is the management group ID, and the value is an object containing a `policy_assignments` map.

```hcl
map(object({
    policy_assignments = map(object({
      enforcement_mode = optional(string, null)
      identity         = optional(string, null)
      identity_ids     = optional(list(string), null)
      parameters       = optional(map(string), null)
      not_scopes       = optional(list(string), null)
      non_compliance_messages = optional(set(object({
        message                        = string
        policy_definition_reference_id = optional(string, null)
      })), null)
      resource_selectors = optional(list(object({
        name = string
        resource_selector_selectors = optional(list(object({
          kind   = string
          in     = optional(set(string), null)
          not_in = optional(set(string), null)
        })), [])
      })))
      overrides = optional(list(object({
        kind  = string
        value = string
        override_selectors = optional(list(object({
          kind   = string
          in     = optional(set(string), null)
          not_in = optional(set(string), null)
        })), [])
      })))
      creation_enabled = optional(bool, true)
    }))
  }))
```

--------------------------------

### Create Azure User Assigned Identity

Source: https://github.com/azure/terraform-azurerm-avm-ptn-alz/blob/main/examples/policy-assignment-modification-with-custom-lib/README.md

Provision a user-assigned managed identity in Azure. This identity can be used by resources to authenticate to other Azure services.

```hcl
resource "azurerm_user_assigned_identity" "this" {
  location            = azurerm_resource_group.this.location
  name                = local.user_assigned_identity_name
  resource_group_name = azurerm_resource_group.this.name
}
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.