v0.17.1

Summary

In this series of updates, we'd like to highlight the first-time contributors who participated in this release. We sincerely appreciate your contributions! Additionally, we've introduced the following new features:

• Introduced Resource Locks to ALZ Bicep Modules to enhance security and governance capabilities. Thank you, @DaFitRobsta!
• Added parameter files and associated wiki for connectivity modules to incorporate resources with availability zones configured by default. Thank you, @sebassem and @bobanda87!
• Implemented new deployment toggles in hub-spoke configurations, providing users with increased flexibility and control over deployment of the VPN and ExpressRoute Gateways.
• Add support for new Azure Regions (Israel Central, Italy North, and Poland Central). Thank you, @jtracey93!

We've also incorporated the policy refresh for Q2 FY24, to see all of the changes, please take a look at the release notes from the Enterprise-Scale repository.
 

What's Changed

• Docs: update for new accelerator update process by @jaredfholgate in #692
• Feature: Incorporate availability zone param file for hubNetworking module by @bobanda87 in #690
• Feature: Add support for new Azure Regions by @jtracey93 in #693
• Docs: General Accelerator doc updates by @oZakari in #696
• Bug: Added missing parTags to the private zone links by @sergey-netdev in #698
• Bug: Fix deployment toggle to hub-spoke by adding AzBastionEnabled boolean to resBastionSubnetRef by @FallenHoot in #700
• Docs: Additional Accelerator upgrade guidance by @stalejohnsen in #708
• Feature: Added new deployment toggles to hub-spoke by @oZakari in #699
• Bug: Use GITHUB_OUTPUT envvar instead of set-output command by @arunsathiya in #713
• Docs: Documenting minimal network deployment, and fix about modified Modules by @marcosgm in #711
• Docs: Accelerator minimal network deployment updates by @picccard in #715
• Enhancement: AB#31944 Bicep - MDFC VM Vulnerability Assessment provider update to mdeTVM by @marcosgm in #716
• Feature: Add Resource Locking to ALZ Bicep Modules by @DaFitRobsta in #712
• Update: Update Policy Library (automated) by @cae-pr-creator in #717
• Feature: Assign additional built-in Sovereign landing zone policy initiatives by @oZakari in #718
• Docs: Alz resiliency guidance by @sebassem in #722
• Bug: Updates to workflows versions and fix permissions of workflows by @oZakari in #724
• Bug: Fix dead resiliency wiki link by @oZakari in #725
• Update: Update Policy Library (automated) by @cae-pr-creator in #719
• Update: Release-V0.17.1 Updated version.json by @oZakari in #726

Breaking Changes

None 👍

New Contributors

• @bobanda87 made their first contribution in #690
• @sergey-netdev made their first contribution in #698
• @FallenHoot made their first contribution in #700
• @arunsathiya made their first contribution in #713
• @marcosgm made their first contribution in #711

Full Changelog: v0.17.0...V0.17.1

v0.17.0

Summary

This series of updates in the Azure/ALZ-Bicep repository includes various contributions that provide configuration enhancements, documentation improvements, and resolves a variety of bugs.

The following capabilities have been added:

• Adds ability to use custom resource names and/or properties for the following module parameters (Thank you, @johnlokerse!):
  • Logging module - parLogAnalyticsLinkedServiceAutomationAccountName
  • VWAN module - Optional: parVpnGatewayCustomName, parExpressRouteGatewayCustomName, parAzFirewallCustomName, and parVirtualWanHubCustomName,
  • Diagnostic settings modules - parDiagnosticSettingsName
• Enhanced parameter validation with multiple user-defined types for the following module parameters (Thank you, @johnlokerse!):
  • Hub module - parSubnets
  • Policy Assignments module - parPolicyAssignmentNonComplianceMessages
  • VWAN module - virtualWanOptionsType
• Automation Account - Adds parameter to logging module to disable public network access (Thank you, @picccard!)

Breaking Changes

None 👍

What's Changed

• chore: update accelerator release process by @jaredfholgate in #663
• Update alz-bicep-pr2-lint.yml by @baartch in #665
• Update policy_assignment_es_enforce_alz_sandbox.tmpl.json by @chrisking81 in #667
• Update the release version for accelerator config by @oZakari in #668
• Update pester test and workflow triggers by @oZakari in #669
• Accelerator.md fix parameter and version by @stalejohnsen in #670
• Wiki: fix Accelerator Azdevops instructions by @MarcoJanse in #672
• Add type element to contributing-wiki by @picccard in #674
• Fix #680 by @jtracey93 in #681
• Automation account public network access option by @picccard in #677
• chore: remove un-required version number and tidy docs by @jaredfholgate in #685
• Add installation of ALZ Powershell module for policy scripts by @oZakari in #679
• Added several user defined types, ability for custom resources names in vwanConnectivity and mgDiagSettings by @johnlokerse in #656

New Contributors

• @chrisking81 made their first contribution in #667
• @MarcoJanse made their first contribution in #672

Full Changelog: v0.16.6...v0.16,7

v0.16.6

Summary

This is a fairly minor release, fixing a bug for case handling (thanks @baartch) and also some release process improvements for the Accelerator (thanks @jaredfholgate)

What's Changed

• chore: de-couple accelerator releases from alz powershell module releaes by @jaredfholgate in #662
• fix: change gatewayType comparisons to lowercase by @baartch in #659

New Contributors

• @jaredfholgate made their first contribution in #662

Full Changelog: v0.16.5...v0.16.6

v0.16.5

Summary

This release contains a number of changes that add features and functionality for the Sovereign Landing Zone (SLZ)

Although one of these changes, #651 & #652, may be of use to others as it reduces the requirement for Tenant Root "/" permissions to deploy the Management Groups. Review the Management Groups Module README and look to use the managementGroupsScopeEscape.bicep module in place of the managementGroups.bicep if this is of interest to you.

FYI if interested in this you will need permissions on an existing Management Group to target the ARM deployment to 👍

Breaking Changes

None 👍

What's Changed

• Format pipeline-script for mgDiagSettings by @picccard in #648
• Fix #647 by @jtracey93 in #649
• Add new modules for MGs & Subscription Alias with targetScope = MG (Non-Breaking) by @jtracey93 in #651
• Make MG ID Changes Logic To Be Non-Breaking by @jtracey93 in #652
• Update Policy Library (automated) by @cae-pr-creator in #655
• ALZ Policy Assignment for Confidential Corp by @sid2305 in #653

Full Changelog: v0.16.4...v0.16.5

What's Changed

• Format pipeline-script for mgDiagSettings by @picccard in #648
• Fix #647 by @jtracey93 in #649
• Add new modules for MGs & Subscription Alias with targetScope = MG (Non-Breaking) by @jtracey93 in #651
• Make MG ID Changes Logic To Be Non-Breaking by @jtracey93 in #652
• Update Policy Library (automated) by @cae-pr-creator in #655
• ALZ Policy Assignment for Confidential Corp by @sid2305 in #653
• v0.16.5 release updates by @jtracey93 in #657

Full Changelog: v0.16.4...v0.16.5

v0.16.4

Summary

Another packed release with lots of great enhancements and community contributions 🥳😍

At a high level we have added:

• The latest upstream policy refresh from the ALZ repo
  • See the What's New wiki page in the ALZ repo for more info https://aka.ms/alz/whatsnew
• Added privatelink.azuredatabricks.net Private DNS Zone
• AAD Renamed to Entra ID
• Added ability to specify a fallback/failover vNet to link all your Private Link Private DNS Zones too - thanks @Acenl12
• Added VPN GW P2S support in Hub & Spoke model - thanks @juang903
• Azure Firewall changes:
  • Now able to specify Custom DNS Servers in DNS proxy feature - thanks @juang903
  • Now able to specify Threat Intel Mode - thanks @oZakari
  • Outputs now available for Private IP address of Azure Firewall
• Multiple Accelerator enhancements - thanks @MilesCameron-DMs & @oZakari
• Our GitHub Issues now are using GitHub Issue Forms, for an easier expeirence - thanks @jhajduk-microsoft

Things to be aware of

No breaking changes, don't worry 👍

But as part of the policy refresh we have added support for Azure Databricks Private Link/Endpoint configuration in the Deploy-Private-DNS-Zones initative. This requires the privatelink.azuredatabricks.net Private DNS Zone to exist.

Therefore we have updated our Private DNS Zone, Hub Networking & Virtual WAN Modules to deploy this new zone, but if you have made any customizations but want to take our policies in, please be aware that you'll need to ensure this zone is added to your environment 👍

What's Changed

• Acceleratorpics by @MilesCameron-DMs in #579
• Updates to Accelerator Documentation by @oZakari in #614
• Update Policy Library (automated) by @cae-pr-creator in #619
• Github Issue forms by @jhajduk-microsoft in #593
• Update ALZ Repo Bicep with Entra product names by @lachaves in #621
• Update Policy Library (automated) by @cae-pr-creator in #623
• Add fallback vnet for failover dns resolving. by @Acenl12 in #601
• Corrected Accelerator links and steps by @oZakari in #628
• Azure Firewall custom DNS server by @juang903 in #615
• Add Azure Firewall Private IPs as Output for VWAN Modules by @jtracey93 in #631
• Update Accelerator docs for ALZ-PowerShell-Module by @oZakari in #636
• BugFix-ParTopLevelManagementGroupPrefix-description-change by @oZakari in #637
• VPN Gateway P2S support by @juang903 in #617
• Update Policy Library (automated) by @cae-pr-creator in #639
• Add threat intel mode property for applicable firewall resources by @oZakari in #644

New Contributors

• @Acenl12 made their first contribution in #601

Full Changelog: v0.16.3...v0.16.4

v0.16.3

Summary

Another release, its been a busy month, but more great updates to ALZ Bicep 👍

In this release we add:

• Routing Intent support for Virtual WAN modules - https://learn.microsoft.com/azure/virtual-wan/how-to-routing-policies
• Ability to propagate the default route (0.0.0.0/0) from a VWAN Hub to spoke vNets via the enableInternetSecurity property
• Naming flexibility for Virtual WAN Hub Connections, if desired
• Azure Bastion Native Client Support (aka Tunnelling) - https://learn.microsoft.com/azure/bastion/native-client - thanks @juang903 🥳

What's Changed

• Add Bastion native client support by @juang903 in #607
• Add VWAN Features: Routing Intent, VHC Naming, Enable Internet Security by @jtracey93 in #612
• Release v0.16.3 by @jtracey93 in #613

New Contributors

• @juang903 made their first contribution in #607

Full Changelog: v0.16.2...v0.16.3

v0.16.2

Summary

A small patch release with no breaking changes 👍

Finally fixing the Bastion NSG only being deployed when Bastion is enabled 🥳

What's Changed

• fix: Description of parPlatformMgAlzDefaultsEnable by @baartch in #597
• Add paths in push trigger for accelerator workflows by @stalejohnsen in #599
• Update Policy Library (automated) by @cae-pr-creator in #603
• Fix #573 (bastion NSG) again and release v0.16.2 by @jtracey93 in #604
• Bastion NSG Conditional Deployment by @JamJarchitect in #606

Full Changelog: v0.16.1...v0.16.2

v0.16.1

Summary

Just some fixes for the Accelerator around RP registration for MG Diagnostic Settings on the Management Subscription, no other ALZ Bicep module changes

What's Changed

• Remove unnecessary usage of Alz.Tools Module by @jtracey93 in #592
• ALZ-Bicep-Accelerator Register missing resource provider by @sebassem in #595

New Contributors

• @sebassem made their first contribution in #595

Full Changelog: v0.16.0...v0.16.1

v0.16.0

Summary

This release incorporates the ability to preview changes prior to deploying to your environment for the Accelerator. There are also some improvements to the Bicep Linter and associated configurations, bug fixes, and general improvements to the modules.

We have also pulled in the latest upstream policy changes from the Azure/Enterprise-Scale repo. See the What's New? for more info on what.

See the below "What's Changed" section for more information on the enhancements we have made

Highlights

• Accelerator: This release introduces the Azure Bicep What-If operation within the Accelerator deployment scripts to be able to evaluate and analyze changes to your environment during a pull-request.
• Relaxed linting rules and reduce maintenance overhead as part of #568
• Added support for the new Sentinel simplified pricing tier in #582

Breaking Changes

As part of #582 we have introduced a very minor/small "breaking change", technically you don't need to do anything and you will just move to the new pricing model, however if you want to stay on your current/the old pricing model you need to do the following once upgrading to v0.16.0:

1. Set parUseSentinelClassicPricingTiers to true

What's Changed

• Enhance Use of Bicep Linter & Simplify Config by @jtracey93 in #568
• Issue forms by @jhajduk-microsoft in #562
• Documentation: Added release process diagram by @oZakari in #569
• FabricBot: Onboarding to GitOps.ResourceManagement because of FabricBot decommissioning by @microsoft-github-policy-service in #570
• Update Policy Library (automated) by @cae-pr-creator in #572
• Add if (parAzBastionEnabled) to nsg create bastion by @woutermation in #575
• Update Azure resources APIs to recent versions before they are too old over 2 years by @VeronicaSea in #577
• Enhance Accelerator documentation for Git by @oZakari in #580
• Feature addvalidation by @MilesCameron-DMs in #539
• PR for Feature #537: Simplify workflow names in Accelerator by @oZakari in #578
• Add CODEOWNERS & Fix Sentinel Simplified Pricing by @jtracey93 in #582
• Update Policy Library (automated) by @cae-pr-creator in #584

New Contributors

• @microsoft-github-policy-service made their first contribution in #570
• @woutermation made their first contribution in #575
• @VeronicaSea made their first contribution in #577
• @MilesCameron-DMs made their first contribution in #539

Full Changelog: v0.15.0...v0.16.0

v0.16.0-pre

This is a pre-release. Please carry on using v0.15.0 for production deployments.