Add generated azuredeploy.json for healthmodel-servicegroup-discovery (follow-up to #14776)

[alex-frankel]

Auto-generated follow-up to PR #14776.

commit-generated-on-merge was skipped for #14776 because it was a fork PR (guarded by head.repo.full_name == github.repository, see issue #14769). Manually adding the compiled azuredeploy.json that was generated and validated by the /validate run on #14776 (artifact generated-azuredeploy-14776-a4bf43ceeb3a08ce6f60a1274b10a25a4bc25589, workflow run 28605881150).

No template changes — azuredeploy.json is the CI-compiled output of main.bicep as it exists on master post-merge. metadata.json is touched (trailing newline) to satisfy CHECK 0b.

[alex-frankel]

/validate

[github-actions]

🤖 Quickstart Sample Summary

Sample Summary

• This sample deploys an Azure Monitor Health Model designed to discover all resources within an Azure Service Group, including nested Service Groups recursively.
• It automatically adds recommended signals and resource health signals to each discovered resource.
• Deploy by providing a health model name, location, and the full Resource ID of the Service Group to discover.

Resources Deployed

• Microsoft.CloudHealth/healthmodels (defined in main.bicep): The root health model resource.
• Microsoft.CloudHealth/healthmodels/authenticationsettings (main.bicep): Authentication settings for the health model using system-assigned managed identity.
• Microsoft.CloudHealth/healthmodels/discoveryrules (main.bicep): A discovery rule resource that performs recursive Service Group resource discovery based on a Resource Graph query.

Security Findings

• No security issues detected by MSDO scanners (Template Analyzer, Checkov, Trivy, Terrascan).
• No hardcoded secrets or overly permissive access noted.
• Managed Identity used for authentication, which is a security best practice.

Key Parameters

• healthModelName: Name of the health model and root entity.
• location: Azure location for resource deployment; defaults to resource group location.
• serviceGroupId: Full Resource ID of the Azure Service Group to discover.

Notes for Reviewers

• The discovery rule uses a Resource Graph query for recursive discovery of resources in the specified Service Group, which relies on backend support.
• Authentication is configured using a system-assigned managed identity, avoiding storing secrets.
• No README.md content was read in this analysis. Ensure documentation matches the deployment behavior.
• The metadata.json was updated mainly to revise the update date; no functional changes detected.

Files Touched

• main.bicep
• metadata.json

---

Generated by the quickstart summarizer agent (v2 — agentic + MSDO security) · triggered by /validate

[alex-frankel]

/validate