# Configuration for ciam-directories.ps1 in the same directory.
#
# Only values marked [SIGN-IN-VISIBLE] are intended to be visible to a
# customer during authentication. Their exact rendering depends on the
# selected sign-in flow and tenant branding. All other settings below are
# deployment, administration, billing, location, or resource metadata.
#
# The workforce tenant configured by tenantId is the tenant from which the
# script authenticates. The CIAM tenant IDs created by Azure are returned by
# the script after provisioning; they are not known before the first run.

# Microsoft Entra workforce tenant ID used for authentication and tenant
# creation permissions. This is not the CIAM tenant ID created for a stage.
tenantId: '00000000-0000-0000-0000-000000000000'

# Azure subscription that owns the resource groups and CIAM directory
# resources.
subscriptionId: '00000000-0000-0000-0000-000000000000'

# Azure resource provider that exposes CIAM directory resources. Do not change
# this value.
resourceProvider: 'Microsoft.AzureActiveDirectory'

# ARM API version used for CIAM create/update calls. The script validates this
# value against the current API version supported by this setup.
apiVersion: '2023-05-17-preview'

management:
  # Azure region of each resource group. This is resource-group metadata and
  # is independent from the CIAM data-residency location.
  resourceGroupLocation: 'germanywestcentral'

  # Seconds between status checks if Azure still reports a provisioning state
  # after the REST long-running operation has completed.
  pollIntervalSeconds: 30

  # Maximum time, in minutes, used by the script while waiting for a CIAM
  # resource to become readable and reach the Succeeded state.
  operationTimeoutMinutes: 45

ciam:
  # Microsoft Entra External ID data-residency location. This is not an Azure
  # region and is not displayed as customer sign-in text. It determines where
  # the CIAM tenant data is hosted and is immutable after tenant creation.
  location: 'Europe'

  # Two-letter country/region selection used when creating the CIAM tenant.
  # This is tenant metadata, not customer sign-in text, and is immutable after
  # tenant creation.
  countryCode: 'DE'

  sku:
    # CIAM billing/service tier used by the Azure resource. Supported values
    # are Standard, PremiumP1, and PremiumP2. This is administration/billing
    # metadata, not customer sign-in text.
    name: 'Standard'

    # SKU tier required by the CIAM ARM resource API. CIAM currently uses A0
    # for all supported SKU names. Do not change this value.
    tier: 'A0'

  tags:
    # Custom Azure resource tags applied to every CIAM resource and its
    # resource group. Tags are resource metadata, not customer sign-in text.
    workload: 'customer-portal-identity'

    # Identifies the tool that manages the Azure resources.
    managedBy: 'ciam-directories.ps1'

    # Business owner of the Azure resources. Replace this placeholder before
    # provisioning.
    owner: 'REPLACE-OWNER'

    # Technical owner of the Azure resources. Replace this placeholder before
    # provisioning.
    technical-owner: 'REPLACE-TECHNICAL-OWNER'

    # Source repository for the workload and its automation.
    repository: 'REPLACE-MY-REPOSITORY'

graph:
  # Microsoft Graph API version used for custom-domain and branding
  # management. The v1.0 API is the current stable API; it is not the ARM API
  # version above.
  apiVersion: 'v1.0'

  # Delegated Microsoft Graph permissions requested in the CIAM tenant. The
  # signed-in administrator needs the supported Domain Name Administrator and
  # Organizational Branding Administrator roles. These permissions are not
  # visible to customers at sign-in.
  scopes:
    - 'Domain.ReadWrite.All'
    - 'OrganizationalBranding.ReadWrite.All'

  # If true, use device-code authentication for local execution. If false,
  # use the normal interactive browser authentication flow. This is local
  # authentication behavior and is not visible to customers.
  useDeviceCode: false

stages:
  # Stage identifier used by the mandatory -Stage argument. It is also written
  # to the environment tag.
  dev:
    # If false, this stage cannot be provisioned until it is enabled.
    enabled: true

    # Azure Resource Group name for this stage.
    resourceGroupName: 'rg-customer-identity-dev'

    # [SIGN-IN-VISIBLE] CIAM resource name and initial tenant subdomain. This
    # value is used in the CIAM resource name and in the initial domain used by
    # authentication, typically <resourceName>.onmicrosoft.com. For this stage
    # the resulting primary domain is examplecustomersdev.onmicrosoft.com.
    # It must be globally unique, alphanumeric, and no longer than 26 chars.
    resourceName: 'examplecustomersdev'

    # [SIGN-IN-VISIBLE] Human-readable CIAM tenant display name. It can appear
    # in the customer sign-in/account-selection context and in tenant branding,
    # depending on the selected sign-in flow.
    displayName: 'Example Customer Portal DEV'

    customDomain:
      # [SIGN-IN-VISIBLE] Fully qualified custom domain that must become this
      # CIAM tenant's primary/default domain, for example
      # login-dev.example.com. The domain must be owned by you and must not be
      # the initial *.onmicrosoft.com domain. Replace this placeholder.
      name: 'REPLACE-CUSTOM-DOMAIN-DEV'

      # The script always makes this verified custom domain the primary/default
      # tenant domain. Keep this true for the required CIAM setup.
      setAsPrimary: true

      # If true, retry domain verification until the DNS record is visible or
      # the timeout is reached. If false, print the required DNS records and
      # stop when verification is not yet possible. This affects provisioning,
      # not the customer sign-in display.
      waitForVerification: false

      # Seconds between Microsoft Graph verification attempts when waiting is
      # enabled. DNS propagation can take longer than this interval.
      verificationPollIntervalSeconds: 30

      # Maximum number of minutes to wait for DNS verification when waiting is
      # enabled.
      verificationTimeoutMinutes: 30

    branding:
      # Enable Microsoft Entra External ID company branding for this stage.
      # Branding is shown on Microsoft-hosted browser sign-in pages.
      enabled: true

      # RFC 1766 locale of the managed branding localization. Browsers with
      # other languages fall back to the tenant's default branding, which this
      # setup does not populate.
      locale: 'en-US'

      # [SIGN-IN-VISIBLE] Fallback page background color in hexadecimal RGB
      # format. It is also used when the background image cannot load.
      backgroundColor: '#19A974'

      # [SIGN-IN-VISIBLE] Header background color in hexadecimal RGB format.
      headerBackgroundColor: '#0B6B4A'

      # [SIGN-IN-VISIBLE] Text shown below the sign-in box. Do not put secrets
      # or sensitive operational information here.
      signInPageText: 'Example Customer Portal - DEV'

      # [SIGN-IN-VISIBLE] Hint shown in the username input field.
      usernameHintText: 'Email address'

      # [SIGN-IN-VISIBLE] Optional footer text and links. Leave a URL empty
      # when the corresponding custom link should not be configured.
      customPrivacyAndCookiesText: 'Privacy & Cookies'
      customPrivacyAndCookiesUrl: ''
      customTermsOfUseText: 'Terms of Use'
      customTermsOfUseUrl: ''

      assets:
        # [SIGN-IN-VISIBLE] Main sign-in background. Required format is
        # PNG/JPEG, 1920x1080 pixels, and at most 300 KB.
        backgroundImage: 'branding/dev/background-image-1920x1080.jpg'

        # [SIGN-IN-VISIBLE] Banner logo. PNG/JPEG, 245x36 pixels and at most
        # 50 KB. The script enforces the exact recommended size.
        bannerLogo: 'branding/dev/banner-logo-245x36.png'

        # [SIGN-IN-VISIBLE] Header logo. PNG/JPEG, 245x36 pixels and at most
        # 10 KB. The script enforces the exact recommended size.
        headerLogo: 'branding/dev/header-logo-245x36.png'

        # [SIGN-IN-VISIBLE] Browser favicon. Required format is PNG/JPEG,
        # 32x32 pixels, and at most 5 KB.
        favicon: 'branding/dev/favicon-32x32.png'

        # Square logos used by Microsoft Entra surfaces. Required format is
        # PNG/JPEG, 240x240 pixels, and at most 50 KB per file.
        squareLogo: 'branding/dev/square-logo-240x240.png'
        squareLogoDark: 'branding/dev/square-logo-dark-240x240.png'

    # Resource-group delete protection. All stages are protected by default.
    # The lock prevents deletion of this resource group and its resources.
    deleteLock:
      # Set to false only when this stage must intentionally run without the
      # configured delete lock. An existing lock is not removed automatically.
      enabled: true

      # Azure management-lock name. It is visible under Resource group > Locks.
      name: 'ciam-delete-lock-dev'

      # Configurable note shown with the lock in Azure. It does not affect the
      # customer sign-in experience.
      message: 'Do not delete the DEV CIAM resource group or its resources.'

    # Stage-specific resource tags. These are merged with ciam.tags.
    tags:
      environment: 'dev'

  # Stage identifier used by the mandatory -Stage argument. It is also written
  # to the environment tag.
  stg:
    # If false, this stage cannot be provisioned until it is enabled.
    enabled: true

    # Azure Resource Group name for this stage.
    resourceGroupName: 'rg-customer-identity-stg'

    # [SIGN-IN-VISIBLE] CIAM resource name and initial tenant subdomain. This
    # value must be different from dev and prd and globally unique in
    # Microsoft Entra. The resulting primary domain is
    # examplecustomersstg.onmicrosoft.com.
    resourceName: 'examplecustomersstg'

    # [SIGN-IN-VISIBLE] Human-readable CIAM tenant display name. It can appear
    # in the customer sign-in/account-selection context and in tenant branding.
    displayName: 'Example Customer Portal STG'

    customDomain:
      # [SIGN-IN-VISIBLE] Fully qualified custom domain that must become this
      # CIAM tenant's primary/default domain. Replace this placeholder.
      name: 'REPLACE-CUSTOM-DOMAIN-STG'
      # The custom domain is required to become the primary/default domain.
      setAsPrimary: true
      # Retry verification until DNS is visible when true; otherwise print the
      # DNS records and stop so they can be configured at the registrar.
      waitForVerification: false
      # Seconds between verification attempts while waiting.
      verificationPollIntervalSeconds: 30
      # Maximum wait time in minutes while waiting for DNS verification.
      verificationTimeoutMinutes: 30

    branding:
      # Enable Microsoft Entra External ID company branding for this stage.
      enabled: true
      # RFC 1766 locale used for this branding customization.
      locale: 'en-US'
      # [SIGN-IN-VISIBLE] Fallback page background color in hexadecimal RGB.
      backgroundColor: '#F2C94C'
      # [SIGN-IN-VISIBLE] Header background color in hexadecimal RGB.
      headerBackgroundColor: '#B27A00'
      # [SIGN-IN-VISIBLE] Text shown below the sign-in box.
      signInPageText: 'Example Customer Portal - STG'
      # [SIGN-IN-VISIBLE] Hint shown in the username input field.
      usernameHintText: 'Email address'
      # [SIGN-IN-VISIBLE] Optional footer text and links.
      customPrivacyAndCookiesText: 'Privacy & Cookies'
      customPrivacyAndCookiesUrl: ''
      customTermsOfUseText: 'Terms of Use'
      customTermsOfUseUrl: ''
      assets:
        # [SIGN-IN-VISIBLE] 1920x1080 PNG/JPEG background, max. 300 KB.
        backgroundImage: 'branding/stg/background-image-1920x1080.jpg'
        # [SIGN-IN-VISIBLE] 245x36 PNG/JPEG banner logo, max. 50 KB.
        bannerLogo: 'branding/stg/banner-logo-245x36.png'
        # [SIGN-IN-VISIBLE] 245x36 PNG/JPEG header logo, max. 10 KB.
        headerLogo: 'branding/stg/header-logo-245x36.png'
        # [SIGN-IN-VISIBLE] 32x32 PNG/JPEG favicon, max. 5 KB.
        favicon: 'branding/stg/favicon-32x32.png'
        # [SIGN-IN-VISIBLE] 240x240 PNG/JPEG square logos, max. 50 KB each.
        squareLogo: 'branding/stg/square-logo-240x240.png'
        squareLogoDark: 'branding/stg/square-logo-dark-240x240.png'

    # Resource-group delete protection. All stages are protected by default.
    deleteLock:
      # Set to false only when this stage must intentionally run without the
      # configured delete lock. An existing lock is not removed automatically.
      enabled: true

      # Azure management-lock name. It is visible under Resource group > Locks.
      name: 'ciam-delete-lock-stg'

      # Configurable note shown with the lock in Azure. It does not affect the
      # customer sign-in experience.
      message: 'Do not delete the STG CIAM resource group or its resources.'

    # Stage-specific resource tags. These are merged with ciam.tags.
    tags:
      environment: 'stg'

  # Stage identifier used by the mandatory -Stage argument. It is also written
  # to the environment tag.
  prd:
    # If false, this stage cannot be provisioned until it is enabled.
    enabled: true

    # Azure Resource Group name for this stage.
    resourceGroupName: 'rg-customer-identity-prd'

    # [SIGN-IN-VISIBLE] CIAM resource name and initial tenant subdomain. This
    # value must be different from dev and stg and globally unique in
    # Microsoft Entra. The resulting primary domain is
    # examplecustomers.onmicrosoft.com.
    resourceName: 'examplecustomers'

    # [SIGN-IN-VISIBLE] Human-readable CIAM tenant display name. It can appear
    # in the customer sign-in/account-selection context and in tenant branding.
    displayName: 'Example Customer Portal'

    customDomain:
      # [SIGN-IN-VISIBLE] Fully qualified custom domain that must become this
      # CIAM tenant's primary/default domain. Replace this placeholder.
      name: 'REPLACE-CUSTOM-DOMAIN-PRD'
      # The custom domain is required to become the primary/default domain.
      setAsPrimary: true
      # Retry verification until DNS is visible when true; otherwise print the
      # DNS records and stop so they can be configured at the registrar.
      waitForVerification: false
      # Seconds between verification attempts while waiting.
      verificationPollIntervalSeconds: 30
      # Maximum wait time in minutes while waiting for DNS verification.
      verificationTimeoutMinutes: 30

    branding:
      # Enable Microsoft Entra External ID company branding for this stage.
      enabled: true
      # RFC 1766 locale used for this branding customization.
      locale: 'en-US'
      # [SIGN-IN-VISIBLE] Fallback page background color in hexadecimal RGB.
      backgroundColor: '#1261A0'
      # [SIGN-IN-VISIBLE] Header background color in hexadecimal RGB.
      headerBackgroundColor: '#0B3D91'
      # [SIGN-IN-VISIBLE] Text shown below the sign-in box. Production uses
      # the regular product name without an environment marker.
      signInPageText: 'Example Customer Portal'
      # [SIGN-IN-VISIBLE] Hint shown in the username input field.
      usernameHintText: 'Email address'
      # [SIGN-IN-VISIBLE] Optional footer text and links.
      customPrivacyAndCookiesText: 'Privacy & Cookies'
      customPrivacyAndCookiesUrl: ''
      customTermsOfUseText: 'Terms of Use'
      customTermsOfUseUrl: ''
      assets:
        # [SIGN-IN-VISIBLE] 1920x1080 PNG/JPEG background, max. 300 KB.
        backgroundImage: 'branding/prd/background-image-1920x1080.jpg'
        # [SIGN-IN-VISIBLE] 245x36 PNG/JPEG banner logo, max. 50 KB.
        bannerLogo: 'branding/prd/banner-logo-245x36.png'
        # [SIGN-IN-VISIBLE] 245x36 PNG/JPEG header logo, max. 10 KB.
        headerLogo: 'branding/prd/header-logo-245x36.png'
        # [SIGN-IN-VISIBLE] 32x32 PNG/JPEG favicon, max. 5 KB.
        favicon: 'branding/prd/favicon-32x32.png'
        # [SIGN-IN-VISIBLE] 240x240 PNG/JPEG square logos, max. 50 KB each.
        squareLogo: 'branding/prd/square-logo-240x240.png'
        squareLogoDark: 'branding/prd/square-logo-dark-240x240.png'

    # Resource-group delete protection. All stages are protected by default.
    deleteLock:
      # Set to false only when this stage must intentionally run without the
      # configured delete lock. An existing lock is not removed automatically.
      enabled: true

      # Azure management-lock name. It is visible under Resource group > Locks.
      name: 'ciam-delete-lock-prd'

      # Configurable note shown with the lock in Azure. It does not affect the
      # customer sign-in experience.
      message: 'Do not delete the PRD CIAM resource group or its resources.'

    # Stage-specific resource tags. These are merged with ciam.tags.
    tags:
      environment: 'prd'