[SharePoint-ADFS] update template

[Yvand]

PR Checklist

Check these items before submitting a PR...

Contribution Guide

Best Practice Guide

• - Please check this box once you've submitted the PR if you've read through the Contribution Guide and best practices checklist.

Changelog

Added

• Template
  • Added parameter customSharePointConfiguration, to choose what SharePoint features will be configured in the farm

Changed

• Template
  • BREAKING CHANGE: Renamed parameter enableAzureBastion to addBastion
  • Updated bicep modules and resources to their latest version
  • Value Subscription-Latest for parameter sharePointVersion now installs the November 2025 CU for SharePoint Subscription
• DSC
  • Updated the DSC configurations published in repository https://github.com/Yvand/SharePointInfraDsc to v3.1.1 over v2.3.0 (seee changelog).

[azure-quickstarts]

@Yvand - check this PR for updates that may be needed to documentation that references this sample. [This is an automated message. You are receiving it because you are listed as the docOwner in metadata.json.]

[Yvand]

Hello @alex-frankel, I read your comment on my previous update and I wanted to give you additional information.

I always built this template in a separate repository first, and then published updates here when it was relevant, so in that aspect, essentially nothing changed.
However, indeed, recently I moved the DSC code away from my Bicep repository, to a dedicated repository, for multiple reasons:

• The DSC code has become large, and separation was needed for readability and easier tracking of the changes
• The DSC code is used by this Azure template and this Terraform module
• There is now automation to control the quality and test the updates made on the DSC code
• The DSC packages are now built by a GitHub workflow and published as immutable releases. Compared to previously (I built the packages on my dev machine), this is a huge increase in terms of security, because now anyone can control exactly how the DSC packages were built. (To remain compliant with this repository rules, I still copy the DSC packages/code to the dsc subfolder)

[Yvand]

@alex-frankel can you please review this PR?

[alex-frankel]

Hi @Yvand — apologies for the long wait here, and thanks for the nudges. One concrete blocker is holding this up.

The sample-validation pipeline changed since your last update (#14711, which we validated via AzQuickStarts-MAC). CI now requires a testResult block in metadata.json whenever a template file changes, and this PR currently fails on exactly that:

❌ Required field missing or empty: 'testResult'
##[error] metadata.json is missing or has empty required field(s): testResult

The new flow is ADX-backed: you deploy the sample, then record that deployment's correlationId and deploymentName in metadata.json. CI looks the deployment up in the ARM logs and confirms it succeeded and matches the template. Since you already build and deploy this template as part of your own release process, this should just be a matter of capturing those two values from a run and stamping them.

For this sample (no prereqs/ folder) it's a single-object block:

"testResult": {
  "deployments": {
    "templateFileName": "main.bicep",
    "correlationId": "<correlationId from your deployment>",
    "deploymentName": "<your deployment name>"
  }
}

Please also bump dateUpdated when you push.

Docs for reference:

• testResult contract: https://github.com/Azure/azure-quickstart-templates/blob/master/1-CONTRIBUTION-GUIDE/README.md#testresult
• How to obtain the correlationId / deploymentName: https://github.com/Azure/azure-quickstart-templates/blob/master/1-CONTRIBUTION-GUIDE/README.md#how-to-obtain-deployment-results
• Single-deployment (no prereqs) example: https://github.com/Azure/azure-quickstart-templates/blob/master/1-CONTRIBUTION-GUIDE/README.md#single-deployment-no-prereqs
• Diagnosing failures: https://github.com/Azure/azure-quickstart-templates/blob/master/1-CONTRIBUTION-GUIDE/README.md#diagnosing-failures

Once you push the metadata update, I'll re-run validation promptly so we can get this merged without further delay.

[Yvand]

@alex-frankel no worries, thank you for your response, indeed I missed this change entirely.
I updated metadata.json with the required information, I believe it will validate now

[alex-frankel]

/validate

[github-actions]

🤖 Quickstart Sample Summary

Sample Summary

• This sample deploys a highly customizable SharePoint Subscription farm (including versions 2016, 2019, and various Subscription releases up to July 2026 CU) integrated with Active Directory Federation Services (ADFS).

• It provisions a domain controller, a SQL Server 2025 instance, and 1 to 5 SharePoint server roles with detailed configurations such as trusted authentication, user profile services, OAuth trust, dedicated IIS sites for add-ins, and additional SharePoint features.

• Auxiliary features like Azure Bastion for secure VM access and Azure Firewall with explicit proxy policies are included for security and network management.

• To deploy, specify key parameters such as SharePoint version and configuration level, virtual network name, and virtual machine parameters. Deployment leverages Bicep modules and Azure Resource Manager templates with options for custom SharePoint configurations and network security rules.

Resources Deployed

(Extracted from main.bicep and associated Bicep modules)

• Microsoft.Network/virtualNetworks (virtualNetwork.bicep): Defines or references the virtual network in which resources are deployed.
• Microsoft.Network/virtualNetworks/subnets (firewall.bicep): Defines subnets including one named 'AzureFirewallSubnet'.
• Microsoft.Network/firewallPolicies (firewall.bicep): Deploys a firewall policy with explicit proxy enabled on specific HTTP and HTTPS ports.
• Microsoft.Network/firewallPolicies/ruleCollectionGroups (firewall.bicep): Contains firewall rules allowing outbound traffic via explicit proxy.
• Azure Bastion Host (bastion.bicep): Deployed via a reusable module br/public:avm/res/network/bastion-host:0.8.2 for secure VM management within the virtual network.
• Virtual Machine resources (virtualMachine.bicep): Uses a reusable module br/public:avm/res/compute/virtual-machine:0.22.2 to deploy VMs with configurable size, OS image, networking, DSC configurations, and security settings.
• Network Security Group (NSG) (virtualNetwork.bicep): NSG is deployed for the main subnet via module br/public:avm/res/network/network-security-group:0.5.3 with customizable security rules.

Additional Notes:

• DSC (Desired State Configuration) scripts and related zip packages are part of the deployment for configuring the DC, SharePoint front ends, main servers, and SQL servers.
• The template uses multiple Bicep modules and linked ARM templates for modular deployment.

Security Findings

No security issues detected by MSDO scanners (Template Analyzer, Checkov, Trivy, Terrascan).

No explicit hardcoded secrets or overly permissive network access noted in the templates reviewed. Secure parameters such as admin passwords are marked with @secure().

Key Parameters

• sharePointVersion: Specifies the SharePoint version/fix update to deploy (e.g., 'Subscription-Latest', '2019', '2016').
• sharePointConfigurationLevel: Controls the extent of SharePoint farm configuration from 'Custom' to 'Full'.
• customSharePointConfiguration: Array of SharePoint features to configure when sharePointConfigurationLevel is 'Custom'.
• addBastion (formerly enableAzureBastion): Boolean to enable Azure Bastion host deployment for secure VM management.
• virtualNetworkName: Name of the existing or new virtual network for deploying resources.

Notes for Reviewers

• The parameter enableAzureBastion was renamed to addBastion as a breaking change in this update.
• The sample includes updated DSC configurations linked from the external repository for improved SharePoint deployment automation.
• The template supports advanced SharePoint configuration with parameterized feature selection.
• The deployment uses managed modules from the public Azure Verified Modules (AVM) repository for virtual machines, networking, and bastion hosts.
• No security concerns detected; credentials are secured parameters, and network resources have restrictive defaults.

Files Touched

• CHANGELOG.md
• README.md
• azuredeploy.json (entry point template)
• bastion.bicep (Azure Bastion deployment module)
• firewall.bicep (Azure Firewall and proxy policy)
• main.bicep (main orchestrating Bicep template)
• metadata.json
• virtualMachine.bicep (virtual machine deployment module)
• virtualNetwork.bicep (virtual network and NSG module)
• DSC scripts under dsc/ (PowerShell scripts and zip packages for configuration)

---

Generated by the quickstart summarizer agent (v2 — agentic + MSDO security) · triggered by /validate

[alex-frankel]

Validated end-to-end: validate-samples-results (structural) and adx-deployment-validation (ADX deployment lookup + templateHash match) both pass on the current head. The committed azuredeploy.json hashes exactly to the recorded successful deployment. Thanks for the update to the SharePoint-ADFS sample.