Azure Purview Ingestion Private Endpoint Creation using Bicep

Question

In most Azure resource private endpoints, I can configure them using a bicep script by calling 'Microsoft.Network/privateEndpoints'. With Purview, it has two kinds of private endpoints: the regular private endpoint and Ingestion private endpoint. When using the mentioned library, although I can create an endpoint, it is not shown under the Ingestion private endpoint connection name. If you do it through the portal, you will see that endpoint connection created there.

I also notice that there is another API named 'Microsoft.Purview/accounts/privateEndpointConnections' however, it only exposes two properties privateEndpoint.id and privateLinkServiceConnectionState - so this does not look like it will be appropriate to use either?

Therefore I wonder if anyone has tried to use Bicep to do the above? I realize that Purview Private endpoint is still under public preview so maybe there is no way to configure using Bicep yet. I also notice that we cannot export a Purview resource as an ARM template from the Azure Portal, so it leads me even more to believe that Bicep is not available for Purview? Just want to confirm with someone more knowledgeable in this before I decide to give up on it.

Answer 1

As Azure Purview is still In preview it is an evolving tool . Below I am providing two ARM template one for Account and Portal endpoints and one for ingestion endpoints ( I have pasted here two ARM templates and there parametrized file) Note :- Portal, Account and ingestion endpoint should be in same vnet and subnet

1-ARM template for Portal and account endpoint

{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "location": {
        "type": "String"
    },
    "privateEndpointName-account": {
        "type": "String"
    },
    "privateEndpointName-portal": {
        "type": "String"
    },
    "purview_account_externalid": {
        "type": "String"
    },
    "targetSubResource-account": {
        "type": "Array"
    },
    "targetSubResource-portal": {
        "type": "Array"
    },
    "subnet": {
        "type": "String"
    },
    "virtualNetworkName": {
        "type": "String"
    },
    "privateDnsDeploymentName": {
        "type": "String"
    },
    "virtualNetworkLinkName": {
        "type": "String"
    },
    "privateDNS": {
        "type": "String"
    }
},
"resources": [
    {
        "type": "Microsoft.Network/privateEndpoints",
        "apiVersion": "2020-03-01",
        "name": "[parameters('privateEndpointName-account')]",
        "location": "[parameters('location')]",
        "tags": {

        },
        "properties": {
            "subnet": {
                "id": "[concat(resourceGroup().id, '/providers/Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'), '/subnets/', parameters('subnet'))]"
            },
            "privateLinkServiceConnections": [
                {
                    "name": "[parameters('privateEndpointName-account')]",
                    "properties": {
                        "privateLinkServiceId": "[parameters('purview_account_externalid')]",
                        "groupIds": "[parameters('targetSubResource-account')]"
                    }
                }
            ]
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints",
        "apiVersion": "2020-03-01",
        "name": "[parameters('privateEndpointName-portal')]",
        "location": "[parameters('location')]",
        "tags": {

        },
        "properties": {
            "subnet": {
                "id": "[concat(resourceGroup().id, '/providers/Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'), '/subnets/', parameters('subnet'))]"
            },
            "privateLinkServiceConnections": [
                {
                    "name": "[parameters('privateEndpointName-portal')]",
                    "properties": {
                        "privateLinkServiceId": "[parameters('purview_account_externalid')]",
                        "groupIds": "[parameters('targetSubResource-portal')]"
                    }
                }
            ]
        }
    },
    {
        "type": "Microsoft.Resources/deployments",
        "apiVersion": "2017-05-10",
        "name": "[parameters('privateDnsDeploymentName')]",
        "dependsOn": [
            "[parameters('privateEndpointName-portal')]",
            "[parameters('privateEndpointName-account')]"
        ],
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "apiVersion": "2017-05-10",
                        "name": "[concat(parameters('privateDnsDeploymentName'), '-zone')]",
                        "type": "Microsoft.Resources/deployments",
                        "properties": {
                            "mode": "Incremental",
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "resources": [
                                    {
                                        "type": "Microsoft.Network/privateDnsZones",
                                        "apiVersion": "2018-09-01",
                                        "name": "[parameters('privateDNS')]",
                                        "location": "global",
                                        "tags": {

                                        },
                                        "properties": {

                                        }
                                    }
                                ]
                            }
                        }
                    }
                ]
            }
        }
    },
    {
        "type": "Microsoft.Resources/deployments",
        "apiVersion": "2017-05-10",
        "name": "[parameters('virtualNetworkLinkName')]",
        "dependsOn": [
            "[parameters('privateDnsDeploymentName')]"
        ],
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "apiVersion": "2017-05-10",
                        "name": "[concat(parameters('virtualNetworkLinkName'), '-link')]",
                        "type": "Microsoft.Resources/deployments",
                        "properties": {
                            "mode": "Incremental",
                            "template": {
                                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                                "contentVersion": "1.0.0.0",
                                "resources": [
                                    {
                                        "type": "Microsoft.Network/privateDnsZones/virtualNetworkLinks",
                                        "apiVersion": "2018-09-01",
                                        "name": "[concat(parameters('privateDNS'), '/', uniqueString(parameters('virtualNetworkName')))]",
                                        "location": "global",
                                        "properties": {
                                            "virtualNetwork": {
                                                "id": "[concat(resourceGroup().id, '/providers/Microsoft.Network/virtualNetworks/', parameters('virtualNetworkName'))]"
                                            },
                                            "registrationEnabled": false
                                        }
                                    }
                                ]
                            }
                        }
                    }
                ]
            }
        }
    },
    {
        "type": "Microsoft.Resources/deployments",
        "apiVersion": "2017-05-10",
        "name": "[concat(parameters('privateEndpointName-account'), '-', 'default')]",
        "dependsOn": [
            "[parameters('privateEndpointName-account')]",
            "[parameters('privateDnsDeploymentName')]"
        ],
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                        "apiVersion": "2020-03-01",
                        "name": "[concat(parameters('privateEndpointName-account'), '/', 'default')]",
                        "location": "[parameters('location')]",
                        "properties": {
                            "privateDnsZoneConfigs": [
                                {
                                    "name": "[parameters('privateDNS')]",
                                    "properties": {
                                        "privateDnsZoneId": "[concat(resourceGroup().id, '/providers/Microsoft.Network/privateDnsZones/', parameters('privateDNS'))]"
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    },
    {
        "type": "Microsoft.Resources/deployments",
        "apiVersion": "2017-05-10",
        "name": "[concat(parameters('privateEndpointName-portal'), '-', 'default')]",
        "dependsOn": [
            "[parameters('privateEndpointName-portal')]",
            "[parameters('privateDnsDeploymentName')]"
        ],
        "properties": {
            "mode": "Incremental",
            "template": {
                "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
                "contentVersion": "1.0.0.0",
                "resources": [
                    {
                        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
                        "apiVersion": "2020-03-01",
                        "name": "[concat(parameters('privateEndpointName-portal'), '/', 'default')]",
                        "location": "[parameters('location')]",
                        "properties": {
                            "privateDnsZoneConfigs": [
                                {
                                    "name": "[parameters('privateDNS')]",
                                    "properties": {
                                        "privateDnsZoneId": "[concat(resourceGroup().id, '/providers/Microsoft.Network/privateDnsZones/', parameters('privateDNS'))]"
                                    }
                                }
                            ]
                        }
                    }
                ]
            }
        }
    }
]}

2- Parameterized file for Account and Portal Endpoints

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "location": {
        "value": "Type the location of endpoint here"
    },
    "privateEndpointName-account": {
        "value": "Type the name of Account endpoint here"
    },
    "privateEndpointName-portal": {
        "value": "Type the name of Portal Endpoint here"
    },
    "purview_account_externalid": {
        "value": "Go to azure portal > Purview >Properties >Resource Id,This is resource ID of the Purview  "
    },
    "targetSubResource-account": {
        "value": [
            "account"
        ]
    },
    "targetSubResource-portal": {
        "value": [
            "portal"
        ]
    },
    "subnet": {
        "value": "Type the name subnet here "
    },
    "virtualNetworkName": {
        "value": "Type the name of the virtual network here "
    },
    "privateDnsDeploymentName": {
        "value": "privatelink.purview.azure.com"
    },
    "virtualNetworkLinkName": {
        "value": ""
    },
    "privateDNS": {
        "value": "privatelink.purview.azure.com"
    }
}}

3-ARM Template for Ingestion Endpoint

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "ingestionEndpointName": {

        "type": "String"
    },
    "purviewManagedRGId": {

        "type": "String"
    },
    "virtualNetworksName": {

        "type": "String"
    },
    "purviewManagedRGEventHubsNamespaceId": {

        "type": "String"
    },
    "managedStorageAccountName": {
        "type": "string"

    },
    "resourceGroupId": {
        "type": "string"

    },
    "subnet": {
        "type": "String"
    },

    "privateDnsZonesLinkBlob": {
        "defaultValue": "privatelink.blob.core.windows.net",

        "type": "String"
    },
    "privateDnsZonesLinkServicebus": {
        "defaultValue": "privatelink.servicebus.windows.net",

        "type": "String"
    },
    "privateDnsZonesLinkQueue": {
        "defaultValue": "privatelink.queue.core.windows.net",

        "type": "String"
    }

},
"variables": {},
"resources": [
    {
        "type": "Microsoft.Network/privateEndpoints",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-blob')]",
        "location": "eastus",
        "tags": {
            "ContactEmail": "<not defined, please set>",
            "ContactName": "<not defined, please set>",
            "Department": "<not defined, please set>",
            "Environment": "SANDBOX",
            "OwnerName": "<not defined, please set>",
            "Project": "<not defined, please set>"
        },
        "properties": {
            "privateLinkServiceConnections": [
                {
                    "name": "[concat(parameters('ingestionEndpointName'),'-blob')]",
                    "properties": {

                        "privateLinkServiceId": "[concat(parameters('purviewManagedRGId'),'/providers/Microsoft.Storage/storageAccounts/',parameters('managedStorageAccountName'))]",

                        "groupIds": [
                            "blob"
                        ],
                        "privateLinkServiceConnectionState": {
                            "status": "Approved",
                            "description": "Auto-Approved",
                            "actionsRequired": "None"
                        }
                    }
                }
            ],
            "manualPrivateLinkServiceConnections": [],
            "subnet": {
                "id": "[concat(parameters('resourceGroupId'),'/providers/Microsoft.Network/virtualNetworks/',parameters('virtualNetworksName'), '/subnets/',parameters('subnet'))]"
            },
            "customDnsConfigs": []
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-namespace')]",
        "location": "eastus",
        "tags": {
            "ContactEmail": "<not defined, please set>",
            "ContactName": "<not defined, please set>",
            "Department": "<not defined, please set>",
            "Environment": "SANDBOX",
            "OwnerName": "<not defined, please set>",
            "Project": "<not defined, please set>"
        },
        "properties": {
            "privateLinkServiceConnections": [
                {
                    "name": "[concat(parameters('ingestionEndpointName'),'-namespace')]",
                    "properties": {
                        "privateLinkServiceId": "[parameters('purviewManagedRGEventHubsNamespaceId')]",
                        "groupIds": [
                            "namespace"
                        ],
                        "privateLinkServiceConnectionState": {
                            "status": "Approved",
                            "description": "Auto-Approved",
                            "actionsRequired": "None"
                        }
                    }
                }
            ],
            "manualPrivateLinkServiceConnections": [],
            "subnet": {
                "id": "[concat(parameters('resourceGroupId'), '/providers/Microsoft.Network/virtualNetworks/',parameters('virtualNetworksName'), '/subnets/',parameters('subnet'))]"
            },
            "customDnsConfigs": []
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-queue')]",
        "location": "eastus",
        "tags": {
            "ContactEmail": "<not defined, please set>",
            "ContactName": "<not defined, please set>",
            "Department": "<not defined, please set>",
            "Environment": "SANDBOX",
            "OwnerName": "<not defined, please set>",
            "Project": "<not defined, please set>"
        },
        "properties": {
            "privateLinkServiceConnections": [
                {
                    "name": "[concat(parameters('ingestionEndpointName'),'-queue')]",
                    "properties": {
                        "privateLinkServiceId": "[concat(parameters('purviewManagedRGId'),'/providers/Microsoft.Storage/storageAccounts/',parameters('managedStorageAccountName'))]",
                        "groupIds": [
                            "queue"
                        ],
                        "privateLinkServiceConnectionState": {
                            "status": "Approved",
                            "description": "Auto-Approved",
                            "actionsRequired": "None"
                        }
                    }
                }
            ],
            "manualPrivateLinkServiceConnections": [],
            "subnet": {
                "id": "[concat(parameters('resourceGroupId'), '/providers/Microsoft.Network/virtualNetworks/',parameters('virtualNetworksName'), '/subnets/',parameters('subnet'))]"
            },
            "customDnsConfigs": []
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-blob','/default')]",
        "dependsOn": [
            "[resourceId('Microsoft.Network/privateEndpoints', concat(parameters('ingestionEndpointName'),'-blob'))]"
        ],
        "properties": {
            "privateDnsZoneConfigs": [
                {
                    "name": "privatelink-blob-core-windows-net",
                    "properties": {
                        "privateDnsZoneId": "[concat(parameters('resourceGroupId'),'/providers/Microsoft.Network/privateDnsZones/',parameters('privateDnsZonesLinkBlob'))]"
                    }
                }
            ]
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-namespace','/default')]",
        "dependsOn": [
            "[resourceId('Microsoft.Network/privateEndpoints', concat(parameters('ingestionEndpointName'),'-namespace'))]"
        ],
        "properties": {
            "privateDnsZoneConfigs": [
                {
                    "name": "privatelink-servicebus-windows-net",
                    "properties": {
                        "privateDnsZoneId": "[concat(parameters('resourceGroupId'),'/providers/Microsoft.Network/privateDnsZones/',parameters('privateDnsZonesLinkServicebus'))]"

                    }
                }
            ]
        }
    },
    {
        "type": "Microsoft.Network/privateEndpoints/privateDnsZoneGroups",
        "apiVersion": "2020-11-01",
        "name": "[concat(parameters('ingestionEndpointName'),'-queue','/default')]",
        "dependsOn": [
            "[resourceId('Microsoft.Network/privateEndpoints', concat(parameters('ingestionEndpointName'),'-queue'))]"
        ],
        "properties": {
            "privateDnsZoneConfigs": [
                {
                    "name": "privatelink-queue-core-windows-net",
                    "properties": {
                        "privateDnsZoneId": "[concat(parameters('resourceGroupId'),'/providers/Microsoft.Network/privateDnsZones/',parameters('privateDnsZonesLinkQueue'))]"
                    }
                }
            ]
        }
    }
]}

4- Parameterized file for Ingestion Endpoint template

{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
    "ingestionEndpointName": {
        "value": "Type the name of Ingestion Endpoint here"
    },
    "purviewManagedRGId": {
        "value": "Go to azure portal > Purview> ManagedResource  > Properties> Resource id  This is the Resources ID of purview managed resource group"
    },
    "virtualNetworkName": {
        "value": "Give the name of the Virtual network here"
    },
    "purviewManagedRGEventHubsNamespaceId": {
        "value": "Go to azure portal > Purview>Managed Resource > Event Hubs namespace name>properties >Resource IDThis is Purview managed Event hub name space resources Id "
    },
    "managedStorageAccountName": {
        "value": "Go to azure portal > Purview>Managed Resource > Storage Account"
    },
    "resourceGroupId": {
        "value": "Go to azure portal > Purview> overview >resourceGroup"
    },
    "subnet": {
        "value": "Give the name the subnet"
    }
}}