{
   "properties":{
      "displayName":"Configure App Services to use private DNS zones",
      "policyType":"BuiltIn",
      "mode":"Indexed",
      "description":"Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links a virtual network to an App Service. Learn more at: https://docs.microsoft.com/azure/app-service/networking/private-endpoint#dns.",
      "metadata":{
         "version":"1.0.0",
         "category":"App Service"
      },
      "parameters":{
         "privateDnsZoneId":{
            "type":"String",
            "metadata":{
               "displayName":"Private Dns Zone Id",
               "description":"The private DNS zone to deploy in a new private DNS zone group and link to the private endpoint",
               "strongType":"Microsoft.Network/privateDnsZones"
            }
         },
         "effect":{
            "type":"String",
            "metadata":{
               "displayName":"Effect",
               "description":"Enable or disable the execution of the policy"
            },
            "allowedValues":[
               "DeployIfNotExists",
               "Disabled"
            ],
            "defaultValue":"DeployIfNotExists"
         }
      },
      "policyRule":{
         "if":{
            "allOf":[
               {
                  "field":"type",
                  "equals":"Microsoft.Network/privateEndpoints"
               },
               {
                  "count":{
                     "field":"Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*]",
                     "where":{
                        "allOf":[
                           {
                              "field":"Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].privateLinkServiceId",
                              "contains":"Microsoft.Web/sites"
                           },
                           {
                              "field":"Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
                              "equals":"sites"
                           }
                        ]
                     }
                  },
                  "greaterOrEquals":1
               }
            ]
         },
         "then":{
            "effect":"[parameters('effect')]",
            "details":{
               "type":"Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
               "roleDefinitionIds":[
                  "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
               ],
               "deployment":{
                  "properties":{
                     "mode":"incremental",
                     "template":{
                        "$schema":"https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                        "contentVersion":"1.0.0.0",
                        "parameters":{
                           "privateDnsZoneId":{
                              "type":"string"
                           },
                           "privateEndpointName":{
                              "type":"string"
                           },
                           "location":{
                              "type":"string"
                           }
                        },
                        "resources":[
                           {
                              "name":"[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
                              "type":"Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                              "apiVersion":"2020-03-01",
                              "location":"[parameters('location')]",
                              "properties":{
                                 "privateDnsZoneConfigs":[
                                    {
                                       "name":"websites-privateDnsZone",
                                       "properties":{
                                          "privateDnsZoneId":"[parameters('privateDnsZoneId')]"
                                       }
                                    }
                                 ]
                              }
                           }
                        ]
                     },
                     "parameters":{
                        "privateDnsZoneId":{
                           "value":"[parameters('privateDnsZoneId')]"
                        },
                        "privateEndpointName":{
                           "value":"[field('name')]"
                        },
                        "location":{
                           "value":"[field('location')]"
                        }
                     }
                  }
               }
            }
         }
      }
   },
   "id":"/providers/Microsoft.Authorization/policyDefinitions/b318f84a-b872-429b-ac6d-a01b96814452",
   "name":"b318f84a-b872-429b-ac6d-a01b96814452"
}