@aifabrix/builder 2.57.0 → 2.59.0

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "12207364571048202485"
+      "templateHash": "15679444522742934591"
     }
   },
   "parameters": {
@@ -23,6 +23,19 @@
         "description": "Azure region for deployment. Default is the managed resource group location; portal may override via createUiDefinition."
       }
     },
+    "capacityProfile": {
+      "type": "string",
+      "defaultValue": "s",
+      "allowedValues": [
+        "s",
+        "m",
+        "l",
+        "xl"
+      ],
+      "metadata": {
+        "description": "Baseline capacity of the Miso/Keycloak foundation: s (B3), m (P2v3), l (P3v3), xl (P3mv3). One compute instance for every profile. Select the purchased capacity independently of licenseEdition; this does not provision workload environment topology."
+      }
+    },
     "tags": {
       "type": "object",
       "defaultValue": {
@@ -82,7 +95,11 @@
     "deploymentEnvironment": {
       "type": "string",
       "defaultValue": "evaluation",
-      "allowedValues": ["prod", "nonprod", "evaluation"],
+      "allowedValues": [
+        "prod",
+        "nonprod",
+        "evaluation"
+      ],
       "metadata": {
         "description": "Deployment environment used for app runtime defaults. MP UI hardcodes evaluation for now."
       }
@@ -133,7 +150,14 @@
       "type": "bool",
       "defaultValue": true,
       "metadata": {
-        "description": "When false, skip ARM role assignments (CI/CD redeploy without roleAssignments/write). RBAC must already exist."
+        "description": "When false, skip ARM role assignments in THIS resource group (CI/CD redeploy without roleAssignments/write). RBAC must already exist."
+      }
+    },
+    "deployRegistryRoleAssignment": {
+      "type": "bool",
+      "defaultValue": "[parameters('deployRoleAssignments')]",
+      "metadata": {
+        "description": "When false, skip the AcrPull grant on the container registry. That grant lives in the registry's own resource group, which for a customer installation is in the vendor's tenant, where Azure RBAC cannot reach. An installation deployed with registry credentials sets this false and keeps the grants in its own resource group, which it does own."
       }
     },
     "moriBaseUrl": {
@@ -143,6 +167,20 @@
         "description": "Mori base URL for controller tenant activation and Entra handoff (no trailing slash)"
       }
     },
+    "moriLicensePublicKey": {
+      "type": "string",
+      "defaultValue": "",
+      "metadata": {
+        "description": "Mori licence issuer public key in SPKI PEM form. Empty leaves the installation unpinned, and Miso then refuses a licence rather than trusting a key carried inside it."
+      }
+    },
+    "moriLicenseIssuer": {
+      "type": "string",
+      "defaultValue": "mori-controller",
+      "metadata": {
+        "description": "Expected `iss` claim on a Mori licence."
+      }
+    },
     "moriCallbackApiKey": {
       "type": "securestring",
       "defaultValue": "",
@@ -202,7 +240,10 @@
     "onboardingMode": {
       "type": "string",
       "defaultValue": "customerOwned",
-      "allowedValues": ["customerOwned", "saasDirect"],
+      "allowedValues": [
+        "customerOwned",
+        "saasDirect"
+      ],
       "metadata": {
         "description": "Tenant onboarding mode for Miso (ONBOARDING_MODE). customerOwned = portal/Marketplace wizard; saasDirect = Builder SaaS installation. Not exposed in createUiDefinition."
       }
@@ -210,15 +251,44 @@
   },
   "variables": {
     "infrastructureName": "[if(not(empty(parameters('infrastructureNameOverride'))), parameters('infrastructureNameOverride'), resourceGroup().name)]",
+    "capacityProfiles": {
+      "s": {
+        "computeSku": "B3",
+        "postgresSku": "Standard_B2ms",
+        "postgresTier": "Burstable",
+        "postgresStorageGB": 64
+      },
+      "m": {
+        "computeSku": "P2v3",
+        "postgresSku": "Standard_D2ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 128
+      },
+      "l": {
+        "computeSku": "P3v3",
+        "postgresSku": "Standard_D4ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 256
+      },
+      "xl": {
+        "computeSku": "P3mv3",
+        "postgresSku": "Standard_D8ds_v5",
+        "postgresTier": "GeneralPurpose",
+        "postgresStorageGB": 512
+      }
+    },
+    "selectedCapacity": "[variables('capacityProfiles')[parameters('capacityProfile')]]",
     "deploymentLocation": "[parameters('location')]",
     "appInsightsLocation": "[if(equals(variables('deploymentLocation'), 'norwaywest'), 'norwayeast', variables('deploymentLocation'))]",
     "openAiLocationKnown": "[contains(createArray('australiaeast', 'brazilsouth', 'canadaeast', 'eastus', 'eastus2', 'francecentral', 'japaneast', 'koreacentral', 'northcentralus', 'norwayeast', 'polandcentral', 'southafricanorth', 'southcentralus', 'southindia', 'swedencentral', 'switzerlandnorth', 'uksouth', 'westeurope', 'westus', 'westus3'), variables('deploymentLocation'))]",
-    "openAiLocation": "[if(variables('openAiLocationKnown'), variables('deploymentLocation'), 'swedencentral')]",
+    "createAzureOpenAI": "[and(and(parameters('enableAzureOpenAI'), variables('openAiLocationKnown')), not(variables('hostedInstallation')))]",
     "subnetBase": "[add(20, mod(length(variables('infrastructureName')), 230))]",
     "registryPasswordConfigured": "[not(empty(parameters('acrAdminPassword')))]",
     "acrRegistryName": "[toLower(last(split(parameters('acrResourceId'), '/')))]",
     "effectiveAcrLoginServer": "[if(empty(parameters('acrLoginServer')), format('{0}{1}', variables('acrRegistryName'), environment().suffixes.acrLoginServer), parameters('acrLoginServer'))]",
     "registryUsername": "[if(variables('registryPasswordConfigured'), if(empty(parameters('acrAdminUsername')), variables('acrRegistryName'), parameters('acrAdminUsername')), '')]",
+    "hostedInstallation": "[equals(parameters('onboardingMode'), 'saasDirect')]",
+    "effectiveEntraIdTenantId": "[if(variables('hostedInstallation'), '', parameters('entraIdTenantId'))]",
     "keycloakContainerImage": "[format('{0}/aifabrix/keycloak:{1}', variables('effectiveAcrLoginServer'), parameters('keycloakImageTag'))]",
     "misoControllerContainerImage": "[format('{0}/aifabrix/miso-controller:{1}', variables('effectiveAcrLoginServer'), parameters('misoImageTag'))]",
     "keycloakVdirPublic": "/auth",
@@ -369,7 +439,9 @@
               "tags": "[parameters('tags')]",
               "properties": {
                 "addressSpace": {
-                  "addressPrefixes": ["[parameters('vnetAddressSpace')]"]
+                  "addressPrefixes": [
+                    "[parameters('vnetAddressSpace')]"
+                  ]
                 },
                 "subnets": [
                   {
@@ -721,7 +793,9 @@
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.keyVaultPrivateDnsZoneId.value]"
           },
           "allowedIPs": {
-            "value": ["*"]
+            "value": [
+              "*"
+            ]
           },
           "currentUserObjectId": {
             "value": ""
@@ -801,7 +875,10 @@
             "sku": {
               "type": "string",
               "defaultValue": "standard",
-              "allowedValues": ["standard", "premium"],
+              "allowedValues": [
+                "standard",
+                "premium"
+              ],
               "metadata": {
                 "description": "Key Vault SKU (standard or premium)"
               }
@@ -823,7 +900,11 @@
                   "tenantId": "[subscription().tenantId]",
                   "objectId": "[parameters('deploymentIdentityObjectIds')[copyIndex('deploymentIdentityPolicies')]]",
                   "permissions": {
-                    "secrets": ["get", "list", "set"],
+                    "secrets": [
+                      "get",
+                      "list",
+                      "set"
+                    ],
                     "keys": [],
                     "certificates": [],
                     "storage": []
@@ -878,7 +959,9 @@
               "properties": {
                 "accessPolicies": "[variables('currentUserPolicy')]"
               },
-              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+              ]
             },
             {
               "condition": "[and(not(empty(variables('deploymentIdentityPolicies'))), not(variables('shouldGrantCurrentUserPolicy')))]",
@@ -888,7 +971,9 @@
               "properties": {
                 "accessPolicies": "[variables('deploymentIdentityPolicies')]"
               },
-              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+              ]
             },
             {
               "condition": "[and(variables('shouldGrantCurrentUserPolicy'), not(empty(variables('deploymentIdentityPolicies'))))]",
@@ -898,7 +983,9 @@
               "properties": {
                 "accessPolicies": "[concat(variables('currentUserPolicy'), variables('deploymentIdentityPolicies'))]"
               },
-              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Network/privateEndpoints",
@@ -916,12 +1003,16 @@
                     "name": "kv-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]",
-                      "groupIds": ["vault"]
+                      "groupIds": [
+                        "vault"
+                      ]
                     }
                   }
                 ]
               },
-              "dependsOn": ["[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.KeyVault/vaults', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -973,7 +1064,7 @@
       ]
     },
     {
-      "condition": "[parameters('enableAzureOpenAI')]",
+      "condition": "[variables('createAzureOpenAI')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
       "name": "azureOpenAI",
@@ -987,7 +1078,7 @@
             "value": "[variables('infrastructureName')]"
           },
           "location": {
-            "value": "[variables('openAiLocation')]"
+            "value": "[variables('deploymentLocation')]"
           },
           "tags": {
             "value": "[parameters('tags')]"
@@ -1087,7 +1178,9 @@
           }
         }
       },
-      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]"
+      ]
     },
     {
       "type": "Microsoft.Resources/deployments",
@@ -1151,7 +1244,12 @@
             "sku": {
               "type": "string",
               "defaultValue": "Standard_LRS",
-              "allowedValues": ["Standard_LRS", "Standard_GRS", "Standard_RAGRS", "Premium_LRS"],
+              "allowedValues": [
+                "Standard_LRS",
+                "Standard_GRS",
+                "Standard_RAGRS",
+                "Premium_LRS"
+              ],
               "metadata": {
                 "description": "Storage account SKU (e.g., Standard_LRS, Standard_GRS, Premium_LRS)"
               }
@@ -1255,7 +1353,9 @@
               "apiVersion": "2024-01-01",
               "name": "[format('{0}/{1}', parameters('name'), 'default')]",
               "properties": {},
-              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Storage/storageAccounts/blobServices/containers",
@@ -1273,7 +1373,9 @@
               "type": "Microsoft.Storage/storageAccounts/fileServices",
               "apiVersion": "2021-04-01",
               "name": "[format('{0}/{1}', parameters('name'), 'default')]",
-              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Storage/storageAccounts/fileServices/shares",
@@ -1302,12 +1404,16 @@
                     "name": "blob-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
-                      "groupIds": ["blob"]
+                      "groupIds": [
+                        "blob"
+                      ]
                     }
                   }
                 ]
               },
-              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -1343,12 +1449,16 @@
                     "name": "file-pls",
                     "properties": {
                       "privateLinkServiceId": "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]",
-                      "groupIds": ["file"]
+                      "groupIds": [
+                        "file"
+                      ]
                     }
                   }
                 ]
               },
-              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
@@ -1375,7 +1485,9 @@
               "properties": {
                 "value": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', parameters('name')), '2024-01-01').keys[0].value]"
               },
-              "dependsOn": ["[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Storage/storageAccounts', parameters('name'))]"
+              ]
             }
           ],
           "outputs": {
@@ -1432,10 +1544,10 @@
             "value": "[format('{0}-miso-asp', variables('infrastructureName'))]"
           },
           "skuDisplay": {
-            "value": "B2"
+            "value": "[variables('selectedCapacity').computeSku]"
           },
           "capacity": {
-            "value": 2
+            "value": 1
           },
           "tags": {
             "value": "[parameters('tags')]"
@@ -1448,7 +1560,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4988795866576200937"
+              "templateHash": "11613691335280989070"
             }
           },
           "parameters": {
@@ -1471,15 +1583,10 @@
                 "B1",
                 "B2",
                 "B3",
-                "S1",
-                "S2",
-                "S3",
                 "P1v3",
                 "P2v3",
                 "P3v3",
-                "EP1",
-                "EP2",
-                "EP3"
+                "P3mv3"
               ],
               "metadata": {
                 "description": "Select a Linux-compatible App Service Plan SKU with details"
@@ -1507,15 +1614,10 @@
               "B1": "Basic",
               "B2": "Basic",
               "B3": "Basic",
-              "S1": "Standard",
-              "S2": "Standard",
-              "S3": "Standard",
               "P1v3": "PremiumV3",
               "P2v3": "PremiumV3",
               "P3v3": "PremiumV3",
-              "EP1": "ElasticPremium",
-              "EP2": "ElasticPremium",
-              "EP3": "ElasticPremium"
+              "P3mv3": "PremiumV3"
             }
           },
           "resources": [
@@ -1727,7 +1829,9 @@
           }
         }
       },
-      "dependsOn": ["[resourceId('Microsoft.Resources/deployments', 'keyVault')]"]
+      "dependsOn": [
+        "[resourceId('Microsoft.Resources/deployments', 'keyVault')]"
+      ]
     },
     {
       "type": "Microsoft.Resources/deployments",
@@ -1755,13 +1859,13 @@
             "value": "15"
           },
           "skuName": {
-            "value": "Standard_B2ms"
+            "value": "[variables('selectedCapacity').postgresSku]"
           },
           "skuTier": {
-            "value": "Burstable"
+            "value": "[variables('selectedCapacity').postgresTier]"
           },
           "storageSizeGB": {
-            "value": 64
+            "value": "[variables('selectedCapacity').postgresStorageGB]"
           },
           "subnetId": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'network'), '2025-04-01').outputs.postgresSubnetId.value]"
@@ -1851,7 +1955,11 @@
             "skuTier": {
               "type": "string",
               "defaultValue": "Burstable",
-              "allowedValues": ["Burstable", "GeneralPurpose", "MemoryOptimized"],
+              "allowedValues": [
+                "Burstable",
+                "GeneralPurpose",
+                "MemoryOptimized"
+              ],
               "metadata": {
                 "description": "SKU tier for PostgreSQL Flexible Server"
               }
@@ -2190,7 +2298,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "6101318472045983896"
+              "templateHash": "10929433789276981779"
             }
           },
           "parameters": {
@@ -2379,7 +2487,7 @@
                 "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
                 "siteConfig": {
                   "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
-                  "acrUseManagedIdentityCreds": true,
+                  "acrUseManagedIdentityCreds": "[not(variables('registryPasswordConfigured'))]",
                   "appCommandLine": "start --optimized=false",
                   "healthCheckPath": "[variables('keycloakHealthCheckPath')]",
                   "alwaysOn": true,
@@ -2418,7 +2526,9 @@
                   "enabled": true
                 }
               },
-              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
             }
           ],
           "outputs": {
@@ -2491,6 +2601,21 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          },
+          "entraCallbackStateSecret": {
+            "value": "[parameters('entraCallbackStateSecret')]"
+          },
+          "entraIdClientSecret": {
+            "value": "[parameters('entraIdClientSecret')]"
+          },
+          "moriLicensePublicKey": {
+            "value": "[parameters('moriLicensePublicKey')]"
+          },
+          "moriBaseUrl": {
+            "value": "[parameters('moriBaseUrl')]"
+          },
+          "moriCallbackApiKey": {
+            "value": "[parameters('moriCallbackApiKey')]"
           }
         },
         "template": {
@@ -2500,7 +2625,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9394845529752045254"
+              "templateHash": "9634353332764264230"
             }
           },
           "parameters": {
@@ -2568,9 +2693,46 @@
               "metadata": {
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
+            },
+            "entraCallbackStateSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Shared HMAC secret for Entra consent OAuth state (ENTRA_CALLBACK_STATE_SECRET). Generated when empty."
+              }
+            },
+            "entraIdClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
+              }
+            },
+            "moriLicensePublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
+              }
+            },
+            "moriBaseUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
+              }
+            },
+            "moriCallbackApiKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori callback API key, shared by the Miso Controller and Mori."
+              }
             }
           },
           "variables": {
+            "resolvedEntraCallbackStateSecret": "[if(not(empty(parameters('entraCallbackStateSecret'))), parameters('entraCallbackStateSecret'), format('ecs_{0}{1}', uniqueString(resourceGroup().id, parameters('prefix'), 'entra-callback-state-v1'), uniqueString(parameters('prefix'), 'entra-cb-b')))]",
+            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -2660,6 +2822,49 @@
               "properties": {
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-callback-state-secret')]",
+              "properties": {
+                "value": "[variables('resolvedEntraCallbackStateSecret')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
+              "properties": {
+                "value": "[variables('resolvedEntraIdClientSecret')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-license-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriLicensePublicKey')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriBaseUrl')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-base-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriBaseUrl')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriCallbackApiKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-callback-api-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriCallbackApiKey')]"
+              }
             }
           ]
         }
@@ -2710,6 +2915,12 @@
           "keycloakWebAppUrl": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'keycloakWebApp'), '2025-04-01').outputs.webAppUrl.value]"
           },
+          "keycloakVdirPublic": {
+            "value": "[variables('keycloakVdirPublic')]"
+          },
+          "misoVdirPublic": {
+            "value": "/miso"
+          },
           "keycloakRealm": {
             "value": "aifabrix"
           },
@@ -2755,20 +2966,20 @@
           "moriBaseUrl": {
             "value": "[parameters('moriBaseUrl')]"
           },
+          "moriLicensePublicKey": {
+            "value": "[parameters('moriLicensePublicKey')]"
+          },
+          "moriLicenseIssuer": {
+            "value": "[parameters('moriLicenseIssuer')]"
+          },
           "moriCallbackApiKey": {
             "value": "[parameters('moriCallbackApiKey')]"
           },
-          "entraCallbackStateSecret": {
-            "value": "[parameters('entraCallbackStateSecret')]"
-          },
           "entraIdClientId": {
             "value": "[parameters('entraIdClientId')]"
           },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
-          },
           "entraIdTenantId": {
-            "value": "[parameters('entraIdTenantId')]"
+            "value": "[variables('effectiveEntraIdTenantId')]"
           },
           "licenseEdition": {
             "value": "[parameters('licenseEdition')]"
@@ -2790,7 +3001,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "3326510661393380434"
+              "templateHash": "2563187238594401937"
             }
           },
           "parameters": {
@@ -2943,6 +3154,20 @@
                 "description": "MISO controller web app URL (for MISO_WEB_SERVER_URL)"
               }
             },
+            "keycloakVdirPublic": {
+              "type": "string",
+              "defaultValue": "/auth",
+              "metadata": {
+                "description": "Public virtual-directory path for Keycloak (Front Door /auth/*). Builds KEYCLOAK_SERVER_URL."
+              }
+            },
+            "misoVdirPublic": {
+              "type": "string",
+              "defaultValue": "/miso",
+              "metadata": {
+                "description": "Public virtual-directory path for the controller. Emitted as MISO_RELATIVE_PATH."
+              }
+            },
             "enablePostgresPublicAccess": {
               "type": "bool",
               "defaultValue": false,
@@ -2953,7 +3178,11 @@
             "deploymentEnvironment": {
               "type": "string",
               "defaultValue": "nonprod",
-              "allowedValues": ["prod", "nonprod", "evaluation"],
+              "allowedValues": [
+                "prod",
+                "nonprod",
+                "evaluation"
+              ],
               "metadata": {
                 "description": "Deployment environment. Use prod for production; non-prod disables API rate limiting by default"
               }
@@ -2979,25 +3208,25 @@
                 "description": "Optional shared secret for Mori → controller callback, supplied through the Miso installation/application contract."
               }
             },
-            "entraCallbackStateSecret": {
-              "type": "securestring",
+            "moriLicensePublicKey": {
+              "type": "string",
               "defaultValue": "",
               "metadata": {
-                "description": "Optional shared HMAC secret for Entra consent OAuth state, supplied through the Miso installation contract."
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves this installation unpinned."
               }
             },
-            "entraIdClientId": {
+            "moriLicenseIssuer": {
               "type": "string",
-              "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
+              "defaultValue": "mori-controller",
               "metadata": {
-                "description": "Vendor multi-tenant Entra app client ID."
+                "description": "Expected `iss` claim on a Mori licence."
               }
             },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
+            "entraIdClientId": {
+              "type": "string",
+              "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
               "metadata": {
-                "description": "Optional vendor Entra app client secret, supplied through the Miso installation contract."
+                "description": "Vendor multi-tenant Entra app client ID."
               }
             },
             "entraIdTenantId": {
@@ -3017,7 +3246,10 @@
             "onboardingMode": {
               "type": "string",
               "defaultValue": "customerOwned",
-              "allowedValues": ["customerOwned", "saasDirect"],
+              "allowedValues": [
+                "customerOwned",
+                "saasDirect"
+              ],
               "metadata": {
                 "description": "Tenant onboarding mode (ONBOARDING_MODE)."
               }
@@ -3035,10 +3267,27 @@
               "metadata": {
                 "description": "Mori license JWT for controller. Empty uses Mori subscription validation. DEVELOPMENT is ignored when DEPLOYMENT=azure."
               }
+            },
+            "bootstrapAppKeys": {
+              "type": "string",
+              "defaultValue": "dataplane,builder-api,mori-controller",
+              "metadata": {
+                "description": "Workload applications an installer may provision at install time (BOOTSTRAP_APPKEYS)."
+              }
             }
           },
           "variables": {
             "shouldDisableRateLimit": "[if(equals(parameters('deploymentEnvironment'), 'prod'), 'false', 'true')]",
+            "misoOriginUrl": "[if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))]",
+            "misoWebAppOrigin": "[if(endsWith(variables('misoOriginUrl'), '/'), substring(variables('misoOriginUrl'), 0, max(0, sub(length(variables('misoOriginUrl')), 1))), variables('misoOriginUrl'))]",
+            "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
+            "misoPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoInternalUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
+            "misoVdirValue": "[if(empty(variables('misoVdirSegment')), '/', variables('misoVdirSegment'))]",
+            "keycloakWebAppOrigin": "[if(endsWith(parameters('keycloakWebAppUrl'), '/'), substring(parameters('keycloakWebAppUrl'), 0, max(0, sub(length(parameters('keycloakWebAppUrl')), 1))), parameters('keycloakWebAppUrl'))]",
+            "keycloakVdirSegment": "[if(or(equals(parameters('keycloakVdirPublic'), ''), equals(parameters('keycloakVdirPublic'), '/')), '', if(startsWith(parameters('keycloakVdirPublic'), '/'), parameters('keycloakVdirPublic'), format('/{0}', parameters('keycloakVdirPublic'))))]",
+            "keycloakPublicUrl": "[if(empty(variables('keycloakVdirSegment')), variables('keycloakWebAppOrigin'), format('{0}{1}', variables('keycloakWebAppOrigin'), variables('keycloakVdirSegment')))]",
+            "keycloakInternalUrl": "[variables('keycloakPublicUrl')]",
             "databaseUrlAppSettingValue": "[if(not(empty(parameters('databaseUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-0-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "databaseLogUrlAppSettingValue": "[if(not(empty(parameters('databaseLogUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseLogUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-1-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "moriBaseNormalized": "[if(and(greater(length(parameters('moriBaseUrl')), 1), endsWith(parameters('moriBaseUrl'), '/')), substring(parameters('moriBaseUrl'), 0, max(0, sub(length(parameters('moriBaseUrl')), 1))), parameters('moriBaseUrl'))]",
@@ -3083,10 +3332,10 @@
                 "virtualNetworkSubnetId": "[if(not(empty(parameters('vnetSubnetId'))), parameters('vnetSubnetId'), null())]",
                 "siteConfig": {
                   "linuxFxVersion": "[format('DOCKER|{0}', parameters('image'))]",
-                  "acrUseManagedIdentityCreds": true,
+                  "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'CORS_ORIGINS', 'value', format('https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=keycloak-internal-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-web-server-url)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_CONTROLLER_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-internal-server-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MISO_RELATIVE_PATH', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-vdir-public)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', parameters('entraIdClientSecret')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', variables('moriBaseNormalized')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', parameters('moriCallbackApiKey')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', parameters('entraCallbackStateSecret')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_CLIENT_ID', 'value', parameters('entraIdClientId')), createObject('name', 'ENTRA_ID_CLIENT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=entra-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'MORI_CALLBACK_API_KEY', 'value', if(empty(parameters('moriCallbackApiKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-callback-api-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'ENTRA_CALLBACK_STATE_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=entra-callback-state-secret)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3116,7 +3365,9 @@
                   "enabled": true
                 }
               },
-              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
             },
             {
               "type": "Microsoft.Web/sites/config",
@@ -3131,7 +3382,9 @@
                   "mountPath": "/data"
                 }
               },
-              "dependsOn": ["[resourceId('Microsoft.Web/sites', parameters('name'))]"]
+              "dependsOn": [
+                "[resourceId('Microsoft.Web/sites', parameters('name'))]"
+              ]
             }
           ],
           "outputs": {
@@ -3232,7 +3485,11 @@
                       "tenantId": "[subscription().tenantId]",
                       "objectId": "[parameters('webAppPrincipalIds')[copyIndex('accessPolicies')]]",
                       "permissions": {
-                        "secrets": ["get", "list", "set"],
+                        "secrets": [
+                          "get",
+                          "list",
+                          "set"
+                        ],
                         "keys": [],
                         "certificates": [],
                         "storage": []
@@ -3278,7 +3535,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "16977137676176830260"
+              "templateHash": "8140687320474179352"
             }
           },
           "parameters": {
@@ -3304,7 +3561,8 @@
           "variables": {
             "readySetting": {
               "AIFABRIX_KV_ACCESS_READY": "[parameters('readyStamp')]"
-            }
+            },
+            "misoOnboardingSetting": "[variables('readySetting')]"
           },
           "resources": [
             {
@@ -3373,7 +3631,7 @@
                     "value": "[parameters('misoWebAppName')]"
                   },
                   "appSettings": {
-                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('misoWebAppName'), 'appsettings'), '2022-03-01').properties, variables('readySetting'))]"
+                    "value": "[union(list(resourceId('Microsoft.Web/sites/config', parameters('misoWebAppName'), 'appsettings'), '2022-03-01').properties, variables('misoOnboardingSetting'))]"
                   }
                 },
                 "template": {
@@ -3460,6 +3718,12 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
+          },
+          "entraCallbackStateSecret": {
+            "value": "[parameters('entraCallbackStateSecret')]"
+          },
+          "entraIdClientSecret": {
+            "value": "[parameters('entraIdClientSecret')]"
           }
         },
         "template": {
@@ -3469,7 +3733,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9394845529752045254"
+              "templateHash": "9634353332764264230"
             }
           },
           "parameters": {
@@ -3537,9 +3801,46 @@
               "metadata": {
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
+            },
+            "entraCallbackStateSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Shared HMAC secret for Entra consent OAuth state (ENTRA_CALLBACK_STATE_SECRET). Generated when empty."
+              }
+            },
+            "entraIdClientSecret": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
+              }
+            },
+            "moriLicensePublicKey": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori licence issuer public key (SPKI PEM). Empty leaves the installation unpinned."
+              }
+            },
+            "moriBaseUrl": {
+              "type": "string",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori base URL, stored so App Service can reference it instead of holding a literal."
+              }
+            },
+            "moriCallbackApiKey": {
+              "type": "securestring",
+              "defaultValue": "",
+              "metadata": {
+                "description": "Mori callback API key, shared by the Miso Controller and Mori."
+              }
             }
           },
           "variables": {
+            "resolvedEntraCallbackStateSecret": "[if(not(empty(parameters('entraCallbackStateSecret'))), parameters('entraCallbackStateSecret'), format('ecs_{0}{1}', uniqueString(resourceGroup().id, parameters('prefix'), 'entra-callback-state-v1'), uniqueString(parameters('prefix'), 'entra-cb-b')))]",
+            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -3629,6 +3930,49 @@
               "properties": {
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-callback-state-secret')]",
+              "properties": {
+                "value": "[variables('resolvedEntraCallbackStateSecret')]"
+              }
+            },
+            {
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
+              "properties": {
+                "value": "[variables('resolvedEntraIdClientSecret')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-license-public-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriLicensePublicKey')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriBaseUrl')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-base-urlKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriBaseUrl')]"
+              }
+            },
+            {
+              "condition": "[not(empty(parameters('moriCallbackApiKey')))]",
+              "type": "Microsoft.KeyVault/vaults/secrets",
+              "apiVersion": "2023-07-01",
+              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'mori-callback-api-keyKeyVault')]",
+              "properties": {
+                "value": "[parameters('moriCallbackApiKey')]"
+              }
             }
           ]
         }
@@ -3772,7 +4116,7 @@
       ]
     },
     {
-      "condition": "[parameters('deployRoleAssignments')]",
+      "condition": "[parameters('deployRegistryRoleAssignment')]",
       "type": "Microsoft.Resources/deployments",
       "apiVersion": "2025-04-01",
       "name": "acrPullRoleAssignment",
@@ -3801,7 +4145,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "1882530004456299732"
+              "templateHash": "14966069055732756709"
             }
           },
           "parameters": {
@@ -3821,7 +4165,7 @@
             }
           },
           "variables": {
-            "acrPullRoleDefinitionId": "7f951dda-4ed3-4680-a7ca-43b17298f9ac"
+            "acrPullRoleDefinitionId": "7f951dda-4ed3-4680-a7ca-43fe172d538d"
           },
           "resources": [
             {
@@ -4082,6 +4426,20 @@
     "portalUrl": {
       "type": "string",
       "value": "[format('https://portal.azure.com/#@{0}/resource/subscriptions/{1}/resourceGroups/{2}', subscription().tenantId, subscription().subscriptionId, resourceGroup().name)]"
+    },
+    "azureOpenAiCreated": {
+      "type": "string",
+      "metadata": {
+        "description": "`true` when Phase-1 created the Azure OpenAI account in the installation region."
+      },
+      "value": "[if(variables('createAzureOpenAI'), 'true', 'false')]"
+    },
+    "azureOpenAiSkipReason": {
+      "type": "string",
+      "metadata": {
+        "description": "Empty when the account was created; otherwise why it was not."
+      },
+      "value": "[if(variables('createAzureOpenAI'), '', if(parameters('enableAzureOpenAI'), format('Azure OpenAI is not offered in {0}, and it is not relocated to another region automatically. The installation is complete without it: create the account in a supported region yourself, or supply an existing endpoint as an external provider.', variables('deploymentLocation')), 'Azure OpenAI creation was disabled for this installation (enableAzureOpenAI=false).'))]"
     }
   }
-}
+}