fix(infra): address SFI security compliance issues (ADO #43311) by Shreyas-Microsoft · Pull Request #244 · microsoft/Container-Migration-Solution-Accelerator

Shreyas-Microsoft · 2026-05-18T13:13:28Z

Purpose

Addresses ADO #43311 — Container Migration - Check and Fix SFI Issues reported by EXP Team.

The EXP team flagged the following SFI (Secure Future Initiative) items for this accelerator. Each one is addressed below. Pattern reference: microsoft/Modernize-your-code-solution-accelerator#435 (sibling repo's SFI PR).

SFI items addressed

#	SFI item	Status	Where
1	`endToEndEncryptionEnabled: true` for App Service	✅ Fixed (Container Apps equivalent)	`infra/main.bicep`, `infra/main_custom.bicep` — `peerTrafficEncryption` enabled on the Container Apps Environment. This repo runs on Azure Container Apps, not App Service; `peerTrafficEncryption` is the Container Apps equivalent of `endToEndEncryptionEnabled` and enforces mTLS for intra-environment traffic.
2	Data Collection Rule for audit success / audit failure logs	✅ Fixed	`infra/main.bicep`, `infra/main_custom.bicep` — added a `Microsoft.Insights/dataCollectionRules` resource with `windowsEventLogs` source covering Security event IDs 4624 (audit success) and 4625 (audit failure), streaming `Microsoft-SecurityEvent` to the Log Analytics workspace, plus an `OMSGallery/Security` solution attached to the LAW. The DCR is associated with the jumpbox VM.
3	`disableLocalAuth: true` for AI Services	✅ Already in `dev`	`infra/main.bicep:920`, `infra/main_custom.bicep:876` — the `aiFoundryAiServices` resource uses AVM `br/public:avm/res/cognitive-services/account:0.13.2` with `disableLocalAuth: true`, set by a prior refactor commit on `dev`. The `existing` BYO AI Services path is immutable from this Bicep, and the AI Foundry project sub-resource's schema does not expose `disableLocalAuth` (auth is inherited from the parent account). App code (`src/backend-api/`, `src/processor/`) uses Entra ID (`use_entra_id=True`) everywhere; no local-key dependency.
4	`identity: { type: 'SystemAssigned' }` or `'UserAssigned'`	✅ Fixed	`infra/main.bicep`, `infra/main_custom.bicep` — added `identity: { type: 'SystemAssigned' }` to Cosmos DB, Azure Container Registry, and the Jumpbox VM where it was missing. Did not modify resources that already use a user-assigned identity.
5	`encryption.requireInfrastructureEncryption: true` for storage	✅ Fixed (explicit)	`infra/modules/storageAccount.bicep` — added explicit `requireInfrastructureEncryption: true`. The AVM `storage-account:0.26.2` default is already `true`, but SFI policy prefers the property be set explicitly rather than relying on module defaults.

Commits

b410134 — fix(infra): require infrastructure encryption on storage accounts
8d2391f — fix(infra): enable peer traffic encryption on container apps environment
817d529 — fix(infra): add system-assigned identity to cosmos, ACR, and jumpbox VM
ffc1eed — fix(infra): add windows security audit DCR + OMS Security solution
786b7e2 — chore(infra): regenerate main.json from main.bicep

Verification

az bicep build infra/main.bicep — clean (only pre-existing BCP334 warning, unchanged)
Backend unit tests: 585 passed, 93.28% coverage (gate: 82%)
Processor unit tests: 812 passed, 87.44% coverage (gate: 82%)

Does this introduce a breaking change?

Yes
No (infra-only; identity additions are additive; peerTrafficEncryption is transparent to workloads; DCR adds a new resource with no impact on existing ones; requireInfrastructureEncryption matches the existing AVM default)

Golden Path Validation

Existing backend + processor unit suites continue to pass and meet the 82% coverage gate. Infra-only change; no app code touched.

Deployment Validation

az bicep build infra/main.bicep succeeds with no new warnings/errors. infra/main.json regenerated from the updated main.bicep (not hand-edited).

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

…O #43311) Enables double encryption at rest by setting requireInfrastructureEncryption: true on the AVM storage-account modules used by both the standard and custom deployments, plus the (currently unreferenced) wrapper module for parity with Modernize PR #435. Files touched: - infra/main.bicep (inline AVM storage/storage-account:0.20.0) - infra/main_custom.bicep (inline AVM storage/storage-account:0.20.0) - infra/modules/storageAccount.bicep (wrapper around AVM 0.26.2) Addresses SFI item: "add encryption property and make requireInfrastructureEncryption: true for storage account". Mirrors the storage-account change in microsoft/Modernize-your-code-solution-accelerator#435. Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ent (ADO #43311) Sets peerTrafficEncryption: true on the AVM app/managed-environment:0.11.2 module in both deployment variants. This toggles Microsoft.App/managedEnvironments.properties.peerTrafficConfiguration.encryption.enabled, which is the Container Apps equivalent of the App Service endToEndEncryptionEnabled property called out by the SFI scan (this repo deploys Container Apps, not App Service). Files touched: - infra/main.bicep (containerAppsEnvironment module ~L1121) - infra/main_custom.bicep (containerAppsEnvironment module ~L1074) Addresses SFI item: "endToEndEncryptionEnabled: true in App Service". Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…VM (ADO #43311) Audited every resource in the Bicep templates against the SFI "identity required" rule. Resources that support managed identity but were missing one: * Microsoft.DocumentDB/databaseAccounts (cosmosDb) -> add SystemAssigned * Microsoft.ContainerRegistry/registries (containerRegistry) -> add SystemAssigned * Microsoft.Compute/virtualMachines (jumpboxVM) -> add SystemAssigned The jumpbox VM also gains SystemAssigned because the Azure Monitor Agent extension needs an identity to authenticate against the Log Analytics workspace when honoring the SecurityAuditEvents data collection rule association (introduced in a later commit on this branch). Resources already compliant and left untouched: * aiFoundryAiServices -> systemAssigned + userAssignedResourceIds already set * aiFoundryProject -> identity.type = 'SystemAssigned' already set * appConfiguration / avmAppConfigUpdated -> systemAssigned already set * containerAppsEnvironment -> systemAssigned already set * containerAppBackend / Frontend / Processor -> UAMI (appIdentity) already wired * storageAccount -> systemAssigned already set * appIdentity (UAMI itself, N/A) * Bastion / ApplicationInsights / LAW / PrivateDnsZones (do not support / not in SFI scope per user's authoritative list) Files touched: - infra/main.bicep (cosmosDb, jumpboxVM) - infra/main_custom.bicep (cosmosDb, containerRegistry, jumpboxVM) Addresses SFI item: "identity: { type: 'SystemAssigned' } or { type: 'UserAssigned' }". Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…DO #43311) Adds a Data Collection Rule that captures Windows audit success (EventID 4624) and audit failure (EventID 4625) Security events from the jumpbox VM and routes them to the Log Analytics workspace via the Microsoft-SecurityEvent stream. The DCR is associated with the VM through the Azure Monitor Agent extension (extensionMonitoringAgentConfig.dataCollectionRuleAssociations). The OMSGallery Security solution is installed on the workspace so the SecurityEvent table is populated for the routed stream. Pattern mirrors microsoft/Modernize-your-code-solution-accelerator#435 but the audit success and audit failure events are covered by a single xPath (Security!*[System[(EventID=4624 or EventID=4625)]]) routed via the Microsoft-SecurityEvent stream rather than Microsoft-WindowsEvent. All new resources are gated on enablePrivateNetworking && enableMonitoring so non-WAF / non-monitoring deployments are unaffected. Files touched: - infra/main.bicep (jumpboxVM AMA extension; new securitySolution + windowsVmDataCollectionRules) - infra/main_custom.bicep (same additions) Addresses SFI item: "data collection rule ['audit success','audit failure'] logs should be enabled". Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Regenerated infra/main.json via 'az bicep build infra/main.bicep' to pick up the four SFI changes on this branch: * Container Apps Environment peerTrafficEncryption * Storage account requireInfrastructureEncryption * SystemAssigned identity on cosmos / ACR / jumpbox VM * Windows Security audit DCR + OMSGallery/Security solution The large diff is dominated by the inlined AVM data-collection-rule:0.11.0 module definition pulled into main.json by the new windowsVmDataCollectionRules module. No main_custom.json exists in this repo (main_custom.bicep is consumed by tooling that runs bicep on demand). Work item: AB#43311 ADO: https://dev.azure.com/CSACTOSOL/CSA%20Solutioning/_workitems/edit/43311 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR addresses SFI (Secure Future Initiative) compliance items flagged by the EXP team (ADO #43311). It is an infra-only change, applied symmetrically to infra/main.bicep and infra/main_custom.bicep, with infra/main.json regenerated.

Changes:

Enable peerTrafficEncryption on the Container Apps Environment and requireInfrastructureEncryption on storage accounts.
Add system-assigned managed identities to Cosmos DB, Azure Container Registry, and the jumpbox VM.
Add an OMS Security solution and a Windows Security audit (EventID 4624/4625) Data Collection Rule, associated with the jumpbox VM via the Azure Monitor Agent.

Reviewed changes

Copilot reviewed 3 out of 4 changed files in this pull request and generated 3 comments.

File	Description
infra/modules/storageAccount.bicep	Explicitly enable infrastructure encryption and set `keyType: 'Service'`.
infra/main.bicep	Add identities, DCR + Security solution, peer traffic encryption, and storage infra encryption.
infra/main_custom.bicep	Mirror of main.bicep changes for the custom-deployment path.
infra/main.json	Regenerated ARM template reflecting Bicep changes.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+// workspace so that the Microsoft-SecurityEvent stream produced by the data
+// collection rule below populates the SecurityEvent table. Same gate as the
+// DCR. (ADO #43311)
+resource securitySolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (enablePrivateNetworking && enableMonitoring) {


+    extensionMonitoringAgentConfig: enableMonitoring
+      ? {
+          enabled: true
+          tags: allTags
+          dataCollectionRuleAssociations: [
+            {
+              name: 'send-${logAnalyticsWorkspaceResourceName}'
+              dataCollectionRuleResourceId: windowsVmDataCollectionRules!.outputs.resourceId
+            }
+          ]
+        }
+      : null


+// SFI: install the Azure Monitor "Security" solution on the Log Analytics
+// workspace so that the Microsoft-SecurityEvent stream produced by the data
+// collection rule below populates the SecurityEvent table. Same gate as the
+// DCR. (ADO #43311)
+resource securitySolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (enablePrivateNetworking && enableMonitoring) {
+  name: 'Security(${logAnalyticsWorkspaceResourceName})'
+  location: solutionLocation
+  plan: {
+    name: 'Security(${logAnalyticsWorkspaceResourceName})'
+    publisher: 'Microsoft'
+    product: 'OMSGallery/Security'
+    promotionCode: ''
+  }
+  properties: {
+    workspaceResourceId: logAnalyticsWorkspaceResourceId
+  }
+}
+
+// SFI: data collection rule that captures Windows Security audit success
+// (EventID 4624) and audit failure (EventID 4625) events from the jumpbox VM
+// and routes them to Log Analytics via the Microsoft-SecurityEvent stream.
+// (ADO #43311)


Harsh-Microsoft · 2026-05-19T10:30:32Z

+// workspace so that the Microsoft-SecurityEvent stream produced by the data
+// collection rule below populates the SecurityEvent table. Same gate as the
+// DCR. (ADO #43311)
+resource securitySolution 'Microsoft.OperationsManagement/solutions@2015-11-01-preview' = if (enablePrivateNetworking && enableMonitoring) {


you can remove this

Harsh-Microsoft · 2026-05-19T10:31:21Z

+            streams: [
+              'Microsoft-SecurityEvent'
+            ]
+            xPathQueries: [


update xPathQueries to 'Security!*[System[(band(Keywords,13510798882111488)) and (EventID != 4624)]]'

Harsh-Microsoft · 2026-05-19T10:32:02Z

+    location: dataCollectionRulesLocation
+    dataCollectionRuleProperties: {
+      kind: 'Windows'
+      dataSources: {


add performanceCounters as well

Shreyas-Microsoft and others added 5 commits May 18, 2026 18:25

Copilot AI review requested due to automatic review settings May 18, 2026 13:13

Shreyas-Microsoft requested review from Avijit-Microsoft, Dongbumlee, Prajwal-Microsoft, Roopan-Microsoft, Vinay-Microsoft, aniaroramsft, dgp10801, nchandhi, sethsteenken and toherman-msft as code owners May 18, 2026 13:13

Copilot AI reviewed May 18, 2026

View reviewed changes

Copilot started reviewing on behalf of Shreyas-Microsoft May 18, 2026 13:33 View session

Shreyas-Microsoft temporarily deployed to production May 18, 2026 13:41 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 18, 2026 13:53 — with GitHub Actions Inactive

Shreyas-Microsoft temporarily deployed to production May 18, 2026 14:19 — with GitHub Actions Inactive

Harsh-Microsoft reviewed May 19, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(infra): address SFI security compliance issues (ADO #43311)#244

fix(infra): address SFI security compliance issues (ADO #43311)#244
Shreyas-Microsoft wants to merge 5 commits into
devfrom
psl-sw/43311-sfi-security-fixes

Shreyas-Microsoft commented May 18, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Harsh-Microsoft May 19, 2026

Uh oh!

Harsh-Microsoft May 19, 2026

Uh oh!

Harsh-Microsoft May 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Shreyas-Microsoft commented May 18, 2026

Purpose

SFI items addressed

Commits

Verification

Does this introduce a breaking change?

Golden Path Validation

Deployment Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Harsh-Microsoft May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Harsh-Microsoft May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Harsh-Microsoft May 19, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants