Discovery Output to Deployment Input¶

The plan phase produces answers: from a discovery workshop or from a design document. This page maps typical questions to the place in the configuration repository where each answer is entered. Use it to turn a filled-in sheet into the first version of the configuration, without guessing.

The table is generic. It contains no customer values, and your own workshop sheet may word the questions differently.

Check the variable names in your version

The names come from the platform at the time of writing. Before you use a variable, check that it is declared in infra/deploy/<layer>/variables*.tf in the code version you pin. An undeclared variable in a tfvars file is only a warning, so a typo is silently ignored (Config).

Conventions¶

Placeholder	Meaning
`<env-folder>`	The folder that holds `mcp.json` for one platform environment, for example `environments/canary` or `environments/prod`
`<region>`	The folder of one active region, named by the short region name, for example `weu`

Fill canary first. When canary works, copy it to prod and change the values that differ (see Deploy the platform).

Hub (cloud platform)¶

Question	File	Variable	Entry
What is the current Azure billing setup? Give the subscription details.	`<env-folder>/global.auto.tfvars`	`scaffold_subscriptions`	Fill the management, connectivity and identity subscription properties
What is the customer short name (at most six characters, used in names)?	`<env-folder>/global.auto.tfvars`	`scaffold_company_short_name`	The short name
What is the name of the base management group of the platform?	`<primary region>/foundation.auto.tfvars`	`management_group_organization_id`	The management group ID, the starting point of the hierarchy
Which is the primary region?	`<env-folder>/global.auto.tfvars`	`primary_region`	The short name of the region
Which additional regions are needed?	`<env-folder>/global.auto.tfvars`	`active_regions`, `active_regions_names`	The short names, and the matching Azure region names. `primary_region` must be in `active_regions`. See Add a region.
What is the log retention in days for the Log Analytics workspace?	`<region>/management.auto.tfvars`	`log_analytics_workspace_retention_in_days`	Only needed when the value differs from the default of 30 days
What is the Key Vault soft-delete retention in days?	`<region>/management.auto.tfvars`	`key_vault_soft_delete_retention_days`	Only needed when the value differs from the default of 30 days
Is DDoS protection needed?	`<region>/foundation.auto.tfvars`	`create_network_ddos_protection_plan`	`true` to deploy the DDoS protection plan
	`<region>/connectivity.auto.tfvars`, `<region>/identity.auto.tfvars`, `<region>/management.auto.tfvars`	`virtual_network_hub_ddos_protection_plan_enable`	`true` to enable it on the virtual networks of that layer
Is a secondary alert receiver wanted (webhook or e-mail)?	`<primary region>/foundation.auto.tfvars`	`monitor_action_group_general_webhook_receiver` or `monitor_action_group_general_email_receiver`	The address or webhook (Hub config)
Who is the security contact?	`<region>/postdeployment.auto.tfvars`	`security_contact_email`	An address of the customer's security team
Which firewall SKU is needed?	`<region>/connectivity.auto.tfvars`	`firewall_sku_tier`	The SKU tier
Is an Application Gateway with WAF needed?	`<region>/connectivity.auto.tfvars`	`use_application_gateway_module`, `use_web_application_firewall_policy_module`	`true` for both. The gateway and WAF definitions are JSON files (Application Gateway).
Is a point-to-site VPN needed?	`<region>/connectivity.auto.tfvars`	`create_point_to_site_vpn_gateway`	`true`
Are site-to-site VPN tunnels needed?	`<region>/connectivity.auto.tfvars`	`create_vpn_gateway`	`true`
Is BGP needed? Which peer addresses and ASNs?	`<region>/connectivity.auto.tfvars`	`create_virtual_hub_bgp_connection`, `virtual_hub_bgp_connection_*`	`true`, and the peer values
Is ExpressRoute needed?	`<region>/connectivity.auto.tfvars`	`create_express_route_gateway`	`true`
Is Azure Bastion needed?	`<region>/connectivity.auto.tfvars`	`create_bastion_host`	`true`
Which hub address ranges?	`<region>/connectivity.auto.tfvars`	`virtual_hub_address_prefix`, the hub virtual network subnets, `virtual_network_dns_servers`	From the IP plan
Is out-of-hours alert routing for hub alerts needed?	`<region>/connectivity.auto.tfvars`	`hub_247_support`	See Monitoring rules

Other switches are in the feature flags reference and the platform features request.

Platform environment settings (`mcp.json`)¶

Question	Entry in `<env-folder>/mcp.json`
Which Entra ID tenant?	`Azure.TenantId`
Where is the Terraform state stored (subscription, resource group, storage account, container) for the hub and for spokes?	`Azure.TerraformState.Hub.` and `Azure.TerraformState.Spoke.`
Which identity deploys the hub and the spokes?	`Azure.TerraformState.Hub.ServicePrincipalId`, `Azure.TerraformState.Spoke.ServicePrincipalId`
Where do the job runners live, how many, which VM size, which address ranges?	`Azure.JobRunner.*`
Which Azure DevOps organization and agent pool, or which GitHub App?	`AzureDevops.` or `GitHub.`
Which administrative unit, group and service principal prefixes for spokes, and what rotation period?	`SpokeCommon.tenantinfo.*`

The key reference is in Config.

Spoke canvas¶

Question	Where it goes
What is the ID of the Entra ID administrative unit for spoke groups?	`SpokeCommon.tenantinfo.AdministrativeUnitId` in `mcp.json` (older versions: `common.tf` in the spoke configuration)
Which PIM behavior do the spoke groups get (readers, contributors, owners)?	`adInfo.PIMGroupConfig` in each spoke JSON: `nopim`, `self-approve` or `approval` (New spoke)
Which team groups get access?	`adInfo.ProductTeamGroupNames` in each spoke JSON
Must a service connection or repository be created automatically for each spoke?	The optional `azdo` block in the spoke JSON. Leave the block out if not.
Which regions does the spoke use?	`targetRegions` in the spoke JSON

Practical rules¶

Fill canary first, with names that contain the environment, so that you can see what you must change for prod.
Search the whole configuration repository for the placeholder values of the template (for example the template customer name and its subscription IDs). The policy files contain Azure resource IDs.
Every firewall_rule_configuration folder needs at least one JSON file, even if the platform has no rules yet. See Firewall rules for the required keys.
Keep the answered discovery sheet next to the design document, and note any answer that you did not map. Those are the gaps from the plan phase.