@aifabrix/builder 2.62.0 → 2.63.1

package/templates/applications/mirrored-templates.json

@@ -6,7 +6,7 @@
         "repo": "aifabrix-miso",
         "path": "builder/miso-controller/env.template"
       },
-      "sha256": "9b74b94d5d6e7457d22cfe213f2ec9c3dceb75c540df3953aba3b51c35df05c7"
+      "sha256": "c14aba1bd4588e334b89f3714714521e659d29f96bb76fc28ef17cacec47c80f"
     },
     {
       "path": "templates/applications/builder-api/env.template",
@@ -30,7 +30,7 @@
         "repo": "aifabrix-dataplane",
         "path": "builder/dataplane/env.template"
       },
-      "sha256": "d35eda839464a65ebd018064ea7c2d292654891b41d1f56862b052720a78a3cc"
+      "sha256": "3f4abcd6e3b7a8cb8a6029c8841b63c2384b863ef168a2ed0128bd5856119e3f"
     },
     {
       "path": "templates/applications/integration-server/env.template",

package/templates/applications/miso-controller/application.yaml

@@ -4,7 +4,7 @@ app:
   displayName: 'Miso Controller'
   description: 'Miso is the AI Fabrix in-tenant controller and portal layer for securely operating enterprise AI apps inside a customer’s Azure tenant. It provides Entra ID SSO, RBAC, audit logs, environment/app configuration via schemas, and safe secret handling via Key Vault references—ensuring governance, traceability, and predictable UX across portal, SDK, and CLI.'
   type: webapp
-  version: '2.0.91'
+  version: '2.0.95'
 # Image Configuration
 # Set tag to match your build (e.g. aifabrix build miso-controller -t 1.0.0 then tag: 1.0.0)
 # Registry is required so the controller can pull the image (avoids "docker: not found" on the controller host).
@@ -96,6 +96,11 @@ platforms:
         value: 'azure'
       - name: MORI_BASE_URL
         value: 'https://platform.aifabrix.dev/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      # Names the Mori policy-signing pair (MORI_POLICY_KEY_ID); must match Mori's manifest.
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
   # Local Docker runs. No resource group is supplied, so `matchLocalPlatform` takes the FIRST entry
   # declaring the local platform (`dev`) -- this one -- and the literal `aifabrix-local` can never
@@ -135,6 +140,10 @@ platforms:
         value: 'swedencentral'
       - name: MORI_BASE_URL
         value: 'url://mori-controller-internal'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
       # Declared, because the fallback infers it and infers it wrongly here:
       # `resolveCloudVendor` returns 'azure' whenever AZURE_SUBSCRIPTION_ID is set, and every
       # developer box has it from the shared development service principal. A local stack was
@@ -186,6 +195,10 @@ platforms:
       # consumer of it was pointed at a loopback address that does not exist in the cluster.
       - name: MORI_BASE_URL
         value: 'https://platform-{platform}.aifabrix.dev/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
   - resource: aifabrix-ce-*
     name: '*'
@@ -212,6 +225,10 @@ platforms:
       # (`platform-dev.aifabrix.dev/mori`) this entry can follow the pattern used above.
       - name: MORI_BASE_URL
         value: 'https://{resourceGroup}-miso-mori-controller.azurewebsites.net/mori'
+      # Names the Mori policy-signing pair the licence bundle is checked against. Must match
+      # Mori's own POLICY_KEY_ID (aifabrix-mori builder/mori-controller/application.yaml).
+      - name: POLICY_KEY_ID
+        value: 'mori-policy-key-1'
 
 configuration:
   # -------------------------------------------------------------------------

package/templates/applications/miso-controller/env.template

@@ -148,8 +148,7 @@ REDIS_PERMISSIONS_TTL=900
 # sync-application-urls-from-env.service.
 #
 # After POST /api/ide/onboarding/entra-id/configure succeeds, controller adds Microsoft Entra IdP to stock Keycloak
-# using the customer enterprise app (AI Fabrix Miso), not the vendor ENTRA_ID_CLIENT_ID app.
-# After configure: Keycloak broker redirect is on the customer enterprise app (AI Fabrix Miso), not ENTRA_ID_CLIENT_ID.
+# using the customer enterprise app (AI Fabrix Miso); its broker redirect is on that app.
 
 KEYCLOAK_REALM=aifabrix
 # Public issuer / browser URL (includes /auth when Keycloak uses KC_HTTP_RELATIVE_PATH=/auth).
@@ -231,16 +230,8 @@ MISO_CLIENTSECRET=kv://miso-controller-client-secretKeyVault
 # Kept in the shared block because EITHER mode may install Entra later from the plan 219
 # provider catalogue: Azure hosting does not force Entra, and SaaS may choose it.
 #
-# AI Fabrix vendor app for TA-1 admin consent and Entra ID configure flows.
-# Same ENTRA_ID_CLIENT_ID / ENTRA_ID_CLIENT_SECRET on every deployment.
-# Customer SSO after configure uses a separate enterprise app (AI Fabrix Miso);
-# Keycloak broker redirect is on that customer app, not ENTRA_ID_CLIENT_ID.
-#
-# ENTRA_ID_CENTRAL_CALLBACK_URI — Web redirect on the vendor app; must point at
-# Mori (e.g. …/entra-id-concent/callback), not the SPA or controller.
-ENTRA_ID_CENTRAL_CALLBACK_URI=url://mori-controller-public/entra-id-concent/callback
-ENTRA_ID_CLIENT_ID=kv://entra-client-idKeyVault
-ENTRA_ID_CLIENT_SECRET=kv://entra-client-secretKeyVault
+# No Entra client id, secret or callback here. Mori owns the app registration and every
+# sign-in; Miso only says which scopes it needs (plan 248.0, remove-vendor-app-secret-from-miso).
 
 # =============================================================================
 # TENANT ACTIVATION (TA-3) — EXISTING LLM CATALOG — [customerOwned]
@@ -378,15 +369,6 @@ MORI_LICENSE_PUBLIC_KEY=kv://mori-license-public-keyKeyVault
 # MORI_LICENSE_PUBLIC_KEY_FILE=/run/secrets/mori-license-public-key.pem
 MORI_LICENSE_ISSUER=mori-controller
 
-# =============================================================================
-# ENTRA ID ONBOARDING (delegated Graph via Mori)
-# =============================================================================
-# Must match a Web redirect URI on the vendor multi-tenant app and Mori’s route
-# …/entra-graph-delegated/callback. Shared pro Mori addon (CICD *-miso-rg):
-ENTRA_GRAPH_DELEGATED_REDIRECT_URI=url://mori-controller-public/entra-graph-delegated/callback
-
-# Optional delegated Graph scopes for GET …/graph-auth-url (space- or comma-separated).
-# ENTRA_GRAPH_DELEGATED_SCOPES=https://graph.microsoft.com/Application.ReadWrite.All,https://graph.microsoft.com/Group.ReadWrite.All,https://graph.microsoft.com/Synchronization.ReadWrite.All,openid,profile,offline_access
 
 # Dev only: log full delegated Graph JWT in general_log_* as delegatedGraphJwt (default off).
 # LOG_GRAPH_TOKEN=true

package/templates/applications/miso-controller/rbac.yaml

@@ -91,6 +91,10 @@ permissions:
     roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
     description: 'Delete groups'
 
+  - name: 'user-groups:update'
+    roles: ['aifabrix-security-admin']
+    description: 'Manage user-group memberships'
+
   # Administrative Permissions
   - name: 'admin:read'
     roles: ['aifabrix-platform-admin']
@@ -315,15 +319,15 @@ permissions:
     description: 'View dimensions and dimension values'
 
   - name: 'dimensions:create'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Create dimensions and dimension values'
 
   - name: 'dimensions:update'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Update dimensions and dimension values'
 
   - name: 'dimensions:delete'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Delete dimensions and dimension values'
 
   # Resource Type Management
@@ -363,15 +367,15 @@ permissions:
     description: 'View business roles'
 
   - name: 'roles:create'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Create business roles'
 
   - name: 'roles:update'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin', 'aifabrix-deployment-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Update business roles'
 
   - name: 'roles:delete'
-    roles: ['aifabrix-platform-admin', 'aifabrix-security-admin']
+    roles: ['aifabrix-security-admin']
     description: 'Delete business roles'
 
   # Evidence Kind Management

package/templates/marketplace/main.json

@@ -5,7 +5,7 @@
     "_generator": {
       "name": "bicep",
       "version": "0.47.16.16243",
-      "templateHash": "703508813427294425"
+      "templateHash": "17889093247943830402"
     }
   },
   "parameters": {
@@ -179,20 +179,6 @@
         "description": "Expected `iss` claim on a Mori licence."
       }
     },
-    "entraIdClientId": {
-      "type": "string",
-      "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
-      "metadata": {
-        "description": "Vendor Entra multi-tenant app client ID. Default matches vendor miso-controller .env (not in createUiDefinition)."
-      }
-    },
-    "entraIdClientSecret": {
-      "type": "securestring",
-      "defaultValue": "",
-      "metadata": {
-        "description": "Optional vendor Entra app client secret. Configure through the Miso installation contract."
-      }
-    },
     "entraIdTenantId": {
       "type": "string",
       "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
@@ -2540,9 +2526,6 @@
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
           },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
-          },
           "moriLicensePublicKey": {
             "value": "[parameters('moriLicensePublicKey')]"
           },
@@ -2560,7 +2543,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4650500285752133401"
+              "templateHash": "6681447246114830480"
             }
           },
           "parameters": {
@@ -2629,13 +2612,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
-              }
-            },
             "moriLicensePublicKey": {
               "type": "string",
               "defaultValue": "",
@@ -2659,7 +2635,6 @@
             }
           },
           "variables": {
-            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -2750,14 +2725,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
-              "properties": {
-                "value": "[variables('resolvedEntraIdClientSecret')]"
-              }
-            },
             {
               "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",
@@ -2891,9 +2858,6 @@
           "moriLicenseIssuer": {
             "value": "[parameters('moriLicenseIssuer')]"
           },
-          "entraIdClientId": {
-            "value": "[parameters('entraIdClientId')]"
-          },
           "entraIdTenantId": {
             "value": "[variables('effectiveEntraIdTenantId')]"
           },
@@ -2926,7 +2890,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "9991546815810387946"
+              "templateHash": "16391707537665698614"
             }
           },
           "parameters": {
@@ -3136,13 +3100,6 @@
                 "description": "Expected `iss` claim on a Mori licence."
               }
             },
-            "entraIdClientId": {
-              "type": "string",
-              "defaultValue": "481251f2-a318-47ba-9ad8-40c36f790df1",
-              "metadata": {
-                "description": "Vendor multi-tenant Entra app client ID. No longer emitted as an app setting — Miso does not hold provider credentials; Mori does. Retained so the marketplace parameter surface is unchanged."
-              }
-            },
             "entraIdTenantId": {
               "type": "string",
               "defaultValue": "09aff594-ba37-4af2-bf40-b773b654c563",
@@ -3224,8 +3181,6 @@
             "databaseUrlAppSettingValue": "[if(not(empty(parameters('databaseUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-0-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "databaseLogUrlAppSettingValue": "[if(not(empty(parameters('databaseLogUrlSecretUriWithVersion'))), format('@Microsoft.KeyVault(SecretUri={0})', parameters('databaseLogUrlSecretUriWithVersion')), format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-databases-1-urlKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))]",
             "moriBaseNormalized": "[if(and(greater(length(parameters('moriBaseUrl')), 1), endsWith(parameters('moriBaseUrl'), '/')), substring(parameters('moriBaseUrl'), 0, max(0, sub(length(parameters('moriBaseUrl')), 1))), parameters('moriBaseUrl'))]",
-            "moriEntraGraphDelegatedRedirectUri": "[format('{0}/entra-graph-delegated/callback', variables('moriBaseNormalized'))]",
-            "moriEntraCentralCallbackUri": "[format('{0}/entra-id-concent/callback', variables('moriBaseNormalized'))]",
             "registryCredentialAppSettings": "[if(and(parameters('registryPasswordConfigured'), not(empty(parameters('acrLoginServer')))), createArray(createObject('name', 'DOCKER_REGISTRY_SERVER_USERNAME', 'value', parameters('acrAdminUsername')), createObject('name', 'DOCKER_REGISTRY_SERVER_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-acr-registry-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix')))), createArray())]"
           },
           "resources": [
@@ -3268,7 +3223,7 @@
                   "acrUseManagedIdentityCreds": "[not(parameters('registryPasswordConfigured'))]",
                   "healthCheckPath": "/health",
                   "alwaysOn": true,
-                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'ALLOWED_ORIGINS', 'value', format('http://localhost:*,http://127.0.0.1:*,https://{0}.azurewebsites.net', parameters('name'))), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_EMAIL', 'value', parameters('adminEmail')), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'ENTRA_GRAPH_DELEGATED_REDIRECT_URI', 'value', variables('moriEntraGraphDelegatedRedirectUri')), createObject('name', 'ENTRA_ID_CENTRAL_CALLBACK_URI', 'value', variables('moriEntraCentralCallbackUri')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'INSTALLATION_RESOURCE_MODEL', 'value', parameters('installationResourceModel')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
+                  "appSettings": "[concat(createArray(createObject('name', 'WEBSITES_ENABLE_APP_SERVICE_STORAGE', 'value', 'false'), createObject('name', 'WEBSITES_CONTAINER_START_TIME_LIMIT', 'value', '1800'), createObject('name', 'DATABASE_URL', 'value', variables('databaseUrlAppSettingValue')), createObject('name', 'JWT_SECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-secrets-jwtKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'NODE_ENV', 'value', 'production'), createObject('name', 'LOCATION', 'value', parameters('location')), createObject('name', 'PORT', 'value', '3000'), createObject('name', 'WEBSITE_VNET_ROUTE_ALL', 'value', if(parameters('enablePostgresPublicAccess'), '0', '1')), createObject('name', 'WEBSITE_DNS_SERVER', 'value', '168.63.129.16'), createObject('name', 'DATABASELOG_URL', 'value', variables('databaseLogUrlAppSettingValue')), createObject('name', 'KEY_VAULT_ENABLED', 'value', 'true'), createObject('name', 'SECURITY_STORAGE_MODE', 'value', 'keyvault'), createObject('name', 'KEY_VAULT_URL', 'value', format('https://{0}.vault.azure.net/', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'ENCRYPTION_KEY', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-encryption-keyKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'AUTO_CREATE_TABLES', 'value', if(parameters('autoCreateTables'), 'true', 'false')), createObject('name', 'KEYCLOAK_REALM', 'value', parameters('keycloakRealm')), createObject('name', 'KEYCLOAK_CLIENT_ID', 'value', parameters('keycloakClientId')), createObject('name', 'KEYCLOAK_ADMIN_USERNAME', 'value', parameters('keycloakAdminUsername')), createObject('name', 'KEYCLOAK_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-keycloak-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_PASSWORD', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-onboarding-admin-password)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'ONBOARDING_ADMIN_EMAIL', 'value', parameters('adminEmail')), createObject('name', 'KEYCLOAK_SERVER_URL', 'value', variables('keycloakPublicUrl')), createObject('name', 'KEYCLOAK_INTERNAL_SERVER_URL', 'value', variables('keycloakInternalUrl')), createObject('name', 'KEYCLOAK_TOKEN_TIMEOUT', 'value', '5000'), createObject('name', 'KEYCLOAK_VERIFY_AUDIENCE', 'value', if(parameters('keycloakVerifyAudience'), 'true', 'false')), createObject('name', 'DISABLE_RATE_LIMIT', 'value', variables('shouldDisableRateLimit')), createObject('name', 'SKIP_DB_REDEPLOY', 'value', 'true'), createObject('name', 'MISO_WEB_SERVER_URL', 'value', variables('misoPublicUrl')), createObject('name', 'MISO_CONTROLLER_URL', 'value', variables('misoInternalUrl')), createObject('name', 'MISO_RELATIVE_PATH', 'value', variables('misoVdirValue')), createObject('name', 'CONTROLLER_BASE_URL', 'value', if(not(empty(parameters('misoControllerUrl'))), parameters('misoControllerUrl'), format('https://{0}.azurewebsites.net', parameters('name')))), createObject('name', 'AZURE_SUBSCRIPTION_ID', 'value', subscription().subscriptionId), createObject('name', 'TENANT_ID', 'value', subscription().tenantId), createObject('name', 'DEPLOYMENT', 'value', 'azure'), createObject('name', 'AZURE_RESOURCE_GROUP_NAME', 'value', parameters('resourceGroupName')), createObject('name', 'INFRASTRUCTURE_NAME', 'value', parameters('prefix')), createObject('name', 'ENTRA_ID_TENANT_ID', 'value', parameters('entraIdTenantId')), createObject('name', 'MISO_CLIENTID', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName={1}-miso-clientIdKeyVault)', last(split(parameters('keyVaultId'), '/')), parameters('prefix'))), createObject('name', 'MISO_CLIENTSECRET', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=miso-controller-client-secretKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_BASE_URL', 'value', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-base-urlKeyVault)', last(split(parameters('keyVaultId'), '/')))), createObject('name', 'MORI_LICENSE_PUBLIC_KEY', 'value', if(empty(parameters('moriLicensePublicKey')), '', format('@Microsoft.KeyVault(VaultName={0};SecretName=mori-license-public-keyKeyVault)', last(split(parameters('keyVaultId'), '/'))))), createObject('name', 'MORI_LICENSE_ISSUER', 'value', parameters('moriLicenseIssuer')), createObject('name', 'DOCKER_ENABLE_CI', 'value', 'true'), createObject('name', 'DOCKER_REGISTRY_SERVER_URL', 'value', if(not(empty(parameters('acrLoginServer'))), format('https://{0}', parameters('acrLoginServer')), '')), createObject('name', 'ONBOARDING_CREATE_PIPELINE_CREDENTIALS', 'value', 'true'), createObject('name', 'BOOTSTRAP_APPKEYS', 'value', parameters('bootstrapAppKeys')), createObject('name', 'LICENSE_JWT', 'value', parameters('licenseJwt')), createObject('name', 'INSTALLATION_RESOURCE_MODEL', 'value', parameters('installationResourceModel')), createObject('name', 'LICENSE_EDITION', 'value', parameters('licenseEdition')), createObject('name', 'ONBOARDING_MODE', 'value', parameters('onboardingMode')), createObject('name', 'INSTALLATION_CAPACITY_PROFILE', 'value', parameters('capacityProfile'))), variables('registryCredentialAppSettings'))]",
                   "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
                 },
                 "vnetRouteAllEnabled": "[not(parameters('enablePostgresPublicAccess'))]"
@@ -3663,9 +3618,6 @@
           },
           "encryptionKey": {
             "value": "[reference(resourceId('Microsoft.Resources/deployments', 'bootstrapSecrets'), '2025-04-01').outputs.encryptionKey.value]"
-          },
-          "entraIdClientSecret": {
-            "value": "[parameters('entraIdClientSecret')]"
           }
         },
         "template": {
@@ -3675,7 +3627,7 @@
             "_generator": {
               "name": "bicep",
               "version": "0.47.16.16243",
-              "templateHash": "4650500285752133401"
+              "templateHash": "6681447246114830480"
             }
           },
           "parameters": {
@@ -3744,13 +3696,6 @@
                 "description": "MISO Client Secret (auto-generated if not provided)"
               }
             },
-            "entraIdClientSecret": {
-              "type": "securestring",
-              "defaultValue": "",
-              "metadata": {
-                "description": "Vendor Entra app client secret (ENTRA_ID_CLIENT_SECRET). Placeholder when empty — replace for live Entra flows."
-              }
-            },
             "moriLicensePublicKey": {
               "type": "string",
               "defaultValue": "",
@@ -3774,7 +3719,6 @@
             }
           },
           "variables": {
-            "resolvedEntraIdClientSecret": "[if(not(empty(parameters('entraIdClientSecret'))), parameters('entraIdClientSecret'), format('PLACEHOLDER_ENTRA_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]",
             "misoWebAppOrigin": "[if(endsWith(parameters('misoWebAppUrl'), '/'), substring(parameters('misoWebAppUrl'), 0, max(0, sub(length(parameters('misoWebAppUrl')), 1))), parameters('misoWebAppUrl'))]",
             "misoVdirSegment": "[if(or(equals(parameters('misoVdirPublic'), ''), equals(parameters('misoVdirPublic'), '/')), '', if(startsWith(parameters('misoVdirPublic'), '/'), parameters('misoVdirPublic'), format('/{0}', parameters('misoVdirPublic'))))]",
             "misoWebServerPublicUrl": "[if(empty(variables('misoVdirSegment')), variables('misoWebAppOrigin'), format('{0}{1}', variables('misoWebAppOrigin'), variables('misoVdirSegment')))]",
@@ -3865,14 +3809,6 @@
                 "value": "[if(not(empty(parameters('misoClientSecret'))), parameters('misoClientSecret'), format('PLACEHOLDER_CLIENT_SECRET_MUST_BE_REPLACED_{0}', uniqueString(resourceGroup().id, parameters('prefix'))))]"
               }
             },
-            {
-              "type": "Microsoft.KeyVault/vaults/secrets",
-              "apiVersion": "2023-07-01",
-              "name": "[format('{0}/{1}', parameters('keyVaultName'), 'entra-client-secretKeyVault')]",
-              "properties": {
-                "value": "[variables('resolvedEntraIdClientSecret')]"
-              }
-            },
             {
               "condition": "[not(empty(parameters('moriLicensePublicKey')))]",
               "type": "Microsoft.KeyVault/vaults/secrets",