Feature Flags Reference¶

For the resources behind the switches, see What the platform deploys.

Boolean switches in the hub layers. Set them in <env-folder>/<region>/<layer>.auto.tfvars. The default applies when the variable is not set at all. File is the variables file under infra/deploy/<layer>/.

Most switches need companion variables, such as names, SKUs, address ranges or IDs. These are declared in the same variables file. Read that file before you enable a feature.

connectivity¶

Flag	Default	File	Effect
`create_virtual_wan`	`true`	`variables_virtual_wan.tf`	Virtual WAN
`use_virtual_hub_module`	`true`	`variables_virtual_hub.tf`	Virtual hub (secured hub with the firewall)
`create_vpn_gateway`	`false`	`variables_virtual_hub.tf`	Site-to-site VPN gateway in the virtual hub
`vpn_gateway_bgp_route_translation_for_nat_enabled`	`false`	`variables_virtual_hub.tf`	BGP route translation for NAT on the VPN gateway
`create_express_route_gateway`	`false`	`variables_virtual_hub.tf`	ExpressRoute gateway in the virtual hub
`create_express_route_connection`	`false`	`variables_virtual_hub.tf`	ExpressRoute connection
`express_route_connection_enable_internet_security`	`false`	`variables_virtual_hub.tf`	Internet security on the ExpressRoute connection
`create_virtual_hub_security_partner_provider`	`false`	`variables_virtual_hub.tf`	Security partner provider
`create_virtual_hub_bgp_connection`	`false`	`variables_virtual_hub.tf`	BGP connection on the virtual hub
`use_express_route_circuit_module`	`false`	`variables_express_route_circuit.tf`	ExpressRoute circuit
`create_express_route_circuit`	`true`	`variables_express_route_circuit.tf`	Used together with the flag above
`use_firewall_module`	`false`	`variables_firewall.tf`	Azure Firewall
`use_firewall_policy_module`	`false`	`variables_firewall_policy.tf`	Azure Firewall policy (required by the `firewall` layer)
`firewall_policy_sql_redirect_allowed`	`false`	`variables_firewall_policy.tf`	SQL redirect on the firewall policy
`create_point_to_site_vpn_gateway`	`false`	`variables_point_to_site_vpn_gateway.tf`	Point-to-site VPN
`create_private_dns_zones`	`false`	`variables_private_dns_zone.tf`	Central private DNS zones for Private Endpoints
`use_virtual_network_hub_module`	`true`	`variables_virtual_network_hub.tf`	Hub virtual network (subnets, NSGs, route tables)
`create_virtual_network`	`true`	`variables_virtual_network_hub.tf`	Used together with the flag above
`virtual_network_hub_ddos_protection_plan_enable`	`false`	`variables_virtual_network_hub.tf`	Attach the DDoS plan to the hub VNet
`create_bastion_host`	`true`	`variables_virtual_network_hub.tf`	Azure Bastion
`create_private_dns_resolver`	`true`	`variables_virtual_network_hub.tf`	Private DNS Resolver
`create_private_dns_resolver_dns_forwarding_ruleset`	`true`	`variables_virtual_network_hub.tf`	DNS forwarding ruleset
`create_network_watcher`	`false`	`variables_virtual_network_hub.tf`	Network Watcher
`use_virtual_network_gateway_module`	`false`	`variables_virtual_network_gateway.tf`	Classic VNet gateway (non-vWAN)
`virtual_network_gateway_active_active`	`false`	`variables_virtual_network_gateway.tf`	Active-active for the gateway above
`virtual_network_gateway_default_local_network_gateway_enabled`	`false`	`variables_virtual_network_gateway.tf`	Default local network gateway
`use_web_application_firewall_policy_module`	`false`	`variables_web_application_firewall_policy.tf`	WAF policies from JSON
`use_new_application_firewall_policy_naming`	`false`	`variables_web_application_firewall_policy.tf`	Key WAF policies by `name` instead of file path. Changing it re-keys all policies (destroy + create).
`use_application_gateway_module`	`false`	`variables_application_gateway.tf`	Application Gateway from JSON (the only effective App Gateway switch)
`create_application_gateway`	`true`	`variables_application_gateway.tf`	Passed, but overridden to `true` in `infra/templates/application_gateway/main.tf`
`use_new_application_gateway_naming`	`false`	`variables_application_gateway.tf`	Key gateways by `name` instead of file path. Re-keys on change.
`hub_247_support.enabled`	`false`	`variables_hub_247_support.tf`	After-hours alert routing to a webhook (ADR-0007)

firewall¶

Flag	Default	File	Effect
`use_third_party_firewall_solution`	`false`	`variables_firewall_general.tf`	Skip Azure Firewall rules and IP groups (third-party NVA)
`use_multiregion_fwp_rulecollectiongroup_naming`	`false`	`variables_firewall_rules.tf`	Merge global and regional rule folders
`use_new_fwp_rulecollectiongroup_naming`	`false`	`variables_firewall_rules.tf`	Key rule collection groups by `name`. Re-keys on change.
`use_new_ip_group_naming`	`true`	`variables_ipgroups.tf`	Key IP groups by `name`. Re-keys on change.
`deploy_network_manager_security_admin_rules`	`false`	`variables_network_manager.tf`	Activate Network Manager security admin rules

foundation¶

Flag	Default	File	Effect
`create_network_ddos_protection_plan`	`false`	`variables_ddos_protection_plan.tf`	DDoS protection plan (primary region)
`enable_activity_log_alerts`	`true`	`variables_monitor.tf`	Activity log alerts on the platform subscriptions
`deploy_network_manager`	`false`	`variables_network_manager.tf`	Azure Virtual Network Manager + IPAM pools

management¶

Flag	Default	File	Effect
`use_management_module`	`true`	`variables_management.tf`	Management components (Key Vault, Automation, Log Analytics, storage)
`create_storage_account`	`false`	`variables_management.tf`	Management storage account
`deploy_sentinel`	`true`	`variables_management.tf`	Microsoft Sentinel on the Log Analytics workspace
`log_analytics_workspace_allow_resource_only_permissions`	`false`	`variables_management.tf`	Resource-context access on the workspace
`create_virtual_network` / `use_virtual_network_hub_module`	`true`	`variables_virtual_network.tf`	Management virtual network
`virtual_network_hub_ddos_protection_plan_enable`	`false`	`variables_virtual_network.tf`	DDoS plan on the management VNet

identity¶

Flag	Default	File	Effect
`create_virtual_network`	`true`	`variables_virtual_network.tf`	Identity virtual network

postdeployment¶

Flag	Default	File	Effect
`enable_defender_for_cloud_for_spokes`	`false`	`variables_policy.tf`	Defender for Cloud initiative on `landingzones` (+ related exemptions)
`automatically_start_policy_remediation`	`true`	`variables_policy.tf`	Remediation tasks for management-group assignments
`mirror_exemptions_to_mcsb`	`true`	`variables_policy.tf`	Mirror exemptions to the MCSB assignment
`enable_private_dns_zone_policies`	`true`	`variables_private_dns_policies.tf`	Policy initiative that registers Private Endpoints in the central DNS zones
`alerting_management_groups.<key>.deploy_alerting_*`	`false`	`variables_alerts.tf`	AMBA alert initiatives per management group (see Monitoring rules)

Naming flags (use_new_*_naming, use_multiregion_*). These change the Terraform keys of existing resources. Flipping one on a running platform shows a destroy and recreate of every affected resource. Treat it as a migration, not a standard change.