fix: update event stream names and enforce security settings in Bicep

[Kanchan-Microsoft]

Purpose

This pull request enhances the security and compliance of the infrastructure by updating event stream names, enforcing stricter network and encryption policies, and improving container app ingress security. The changes are applied consistently across both infra/main.bicep and infra/main_custom.bicep, as well as their generated infra/main.json templates.

Security and Compliance Improvements:

• Changed event stream name from 'Microsoft-WindowsEvent' to 'Microsoft-Event' in data collection rules for better alignment with platform standards.
• Added an additional data collection rule to forward 'Microsoft-Event' streams to Log Analytics, improving event logging coverage.
• Enforced infrastructure encryption for storage accounts by setting requireInfrastructureEncryption: true, enhancing data protection at rest.

Container App Ingress Security:

• Set ingressAllowInsecure: false for container apps (API and Web), ensuring only secure (HTTPS) ingress is allowed.

Other Updates:

• Adjusted the order of dependencies for private DNS zones to ensure correct resource deployment sequencing.
• Updated the Bicep template hash to reflect the new configuration.

These changes collectively improve the security posture, compliance, and reliability of the deployed solution.

Does this introduce a breaking change?

• Yes
• No

Golden Path Validation

• I have tested the primary workflows (the "golden path") to ensure they function correctly without errors.

Deployment Validation

• I have validated the deployment process successfully and all services are running as expected with this change.

What to Check

Verify that the following are valid

• ...

Other Information

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR aims to tighten infra security/compliance by adjusting Azure Monitor Data Collection Rule (DCR) stream routing, enforcing stronger storage encryption, and requiring HTTPS-only ingress for Container Apps.

Changes:

• Updated DCR stream naming and added an additional dataFlow intended to route events to Log Analytics.
• Enforced requireInfrastructureEncryption: true on storage accounts.
• Disabled insecure ingress (ingressAllowInsecure: false) for API/Web Container Apps (including update module).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
infra/main_custom.bicep	Updates DCR streams/dataFlows and hardens storage + container app ingress settings.
infra/main.bicep	Mirrors the same security + DCR updates as main_custom.bicep.
infra/main.json	Regenerated ARM template reflecting the Bicep changes (hash, DCR, module params, dependsOn ordering).

Comments suppressed due to low confidence (2)

infra/main.json:1

• The generated ARM template also uses Microsoft-Event for a Windows Event Log DCR stream. If Microsoft-Event is not a schema-supported stream name, deployments will fail or event collection will break. Fix the stream naming in the Bicep source and regenerate this template.
  infra/main.json:1
• This ARM dataFlows entry references Microsoft-Event for both streams and outputStream. If that stream isn’t valid for DCR Windows Event Log collection, this flow will not bind correctly. Update the Bicep to use the correct stream identifiers and regenerate the ARM output.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Harsh-Microsoft]

LGTM

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

Comments suppressed due to low confidence (1)

infra/main.bicep:474

• PR description says an “additional data collection rule” was added to forward Microsoft-Event streams to Log Analytics, but the change shown here adds an additional dataFlows entry within the existing DCR instead of creating a new DCR resource. Please update the PR description to match the implementation (or add the separate DCR if that was the intent).

        {
          streams: [
            'Microsoft-Event'
          ]
          destinations: [
            dcrLogAnalyticsDestinationName
          ]
          transformKql: 'source'
          outputStream: 'Microsoft-Event'
        }