{
    "properties": {
     "displayName": "Configure Azure Cognitive Search services to use private DNS zones",
     "policyType": "BuiltIn",
     "mode": "Indexed",
     "description": "Use private DNS zones to override the DNS resolution for a private endpoint. A private DNS zone links to your virtual network to resolve to your Azure Cognitive Search service. Learn more at: https://aka.ms/azure-cognitive-search/inbound-private-endpoints.",
     "metadata": {
         "category": "Search",
         "version": "1.0.0"
     },
     "parameters": {
         "privateDnsZoneId": {
             "type": "String",
             "metadata": {
                 "displayName": "Private DNS zone ID",
                 "description": "Specifies the private DNS zone to use to configure private endpoint",
                 "strongType": "Microsoft.Network/privateDnsZones"
             }
         },
         "effect": {
             "type": "String",
             "metadata": {
                 "displayName": "Effect",
                 "description": "Enable or disable the execution of the policy"
             },
             "allowedValues": [
                 "DeployIfNotExists",
                 "Disabled"
             ],
             "defaultValue": "DeployIfNotExists"
         }
     },
     "policyRule": {
         "if": {
             "allOf": [
                 {
                     "field": "type",
                     "equals": "Microsoft.Network/privateEndpoints"
                 },
                 {
                     "count": {
                         "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
                         "where": {
                             "field": "Microsoft.Network/privateEndpoints/privateLinkServiceConnections[*].groupIds[*]",
                             "equals": "searchService"
                         }
                     },
                     "greaterOrEquals": 1
                 }
             ]
         },
         "then": {
             "effect": "[parameters('effect')]",
             "details": {
                 "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                 "roleDefinitionIds": [ 
                   "/providers/Microsoft.Authorization/roleDefinitions/4d97b98b-1d4f-4787-a291-c67834d212e7"
                 ],
                 "deployment": {
                     "properties": {
                         "mode": "incremental",
                         "template": {
                             "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
                             "contentVersion": "1.0.0.0",
                             "parameters": {
                                 "privateDnsZoneId": {
                                     "type": "string"
                                 },
                                 "privateEndpointName": {
                                     "type": "string"
                                 },
                                 "location": {
                                     "type": "string"
                                 }
                             },
                             "resources": [
                                 {
                                     "name": "[concat(parameters('privateEndpointName'), '/deployedByPolicy')]",
                                     "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                                     "apiVersion": "2020-03-01",
                                     "location": "[parameters('location')]",
                                     "properties": {
                                         "privateDnsZoneConfigs": [
                                             {
                                                 "name": "searchService-privateDnsZone",
                                                 "properties": {
                                                     "privateDnsZoneId": "[parameters('privateDnsZoneId')]"
                                                 }
                                             }
                                         ]
                                     }
                                 }
                             ]
                         },
                         "parameters": {
                             "privateDnsZoneId": {
                                 "value": "[parameters('privateDnsZoneId')]"
                             },
                             "privateEndpointName": {
                                 "value": "[field('name')]"
                             },
                             "location": {
                                 "value": "[field('location')]"
                             }
                         }
                     }
                 }
             }
         }
     }
 },
 "id": "/providers/Microsoft.Authorization/policyDefinitions/fbc14a67-53e4-4932-abcc-2049c6706009",
 "name": "fbc14a67-53e4-4932-abcc-2049c6706009"
}