Release Infrastructure (BC 2.2.19)

Changelog

Infrastructure 2.2 Changes PDF file

Pre-requisites

Tenant admin account to grant admin consent
User with Owner permissions for the Application registrations to update app registrations (or use Tenant admin account).
User with Owner permissions for Brief Connect azure resource group.
Existing Azure Front Door instance and user with Contribute permissions to configure it
Exchange Admin account
Teams administrator account
Azure DevOps Brief Connect project admin
Brief Connect Admin account

Deployment steps (in order)

Please refer to the Deployment Guide Wiki throughout this update guide.

1. Update existing Azure Resources

Migrate Classic CDN to Azure Front Door

Migrate existing Brief Connect CDN to Azure Front Door using this instruction: https://learn.microsoft.com/en-us/azure/cdn/migrate-tier Preserve CDN endpoint name and domain without changes.

Retain existing Log Analytics Workspace resource with existing logs

It was identified during the initial draft deployment, that LAW resource, associated with Application Insights resource is provisioned into separate resource group. This deployment will provision a new LAW resource in the Brief Connect resource group with other BC resources. Make sure you keep old LAW instance with existing logs for at least for 90 days after the deployment (default retention time for application logs)

2. Set up granular Mail.Send application permissions using Role Based Access Control (RBAC) in Exchange Online

Execute "8.1 Mail.Send Application role assignment" step from the deployment guide.

3. Update Azure DevOps service connection application permissions

Update permissions for Brief Connect DevOps app registration or other service principal that is used for DevOps service connection to run release pipelines. Execute step "2.7.4 Assign permissions" from the deployment guide.

2.7.4 step describes minimal required roles. You can apply it or any higher role if needed. For example, if the app registration has Owner role assigned on RG level, you can keep it as-is and skip this step.

4. Update Azure DevOps Pipelines

Update variables in variable groups

Go to Brief Connect project - Pipelines - Library - Variables group, and update environment associated group.

New name	Old name	Value
-	organizationsAllowedToAccess	Delete variable
-	skipCosmosDbDeployment	Delete variable
-	skipKeyVaultDeployment	Delete variable
-	skipRedisDeployment	Delete variable
-	skipStorageAccountDeployment	Delete variable
-	userAssignedIdentityName	Delete variable
applicationDomainName	-	Domain name of the application. Example: `cdne-syd-shared-tst-bc.azureedge.net`
applicationName	appName	Rename variable name, validate value
authorizedGroupId	authorizedGroupId	Validate value
authorizedGroupName	authorizedGroupName	Validate value
azureFunctionDomainName	-	New value. Base API path, excluding protocol. You can find it in migrated AFD, for migrated endpoint. It has 2 domains there, for this variable you need an ugly auto-generated one. Example: `cdne-syd-shared-tst-bc-bkaye7eye2hyckc8.a02.azurefd.net`
azureRegion	region	Rename variable name, validate value
azureResourceGroupName	resourceGroupName	Rename variable name, validate value
azureResourcesNamePrefix	main_prefix	Rename variable name, validate value
azureStorageAccountDataName	-	New variable Data Storage account name (existing Brief Connect storage account name). For example `stasydsharedtstbc`
azureStorageAccountWebName	-	New variable Static Web Assets Storage account name (will be created). For example `stasydsharedtstbcweb`
clientAppRegistrationClientId	-	New variable Client ID of Brief Connect Client application registration
devOpsAppRegistrationClientId	devops_app_registration_object_id	Rename variable name, validate value
emailNotificationsServiceAccount	emailNotificationsServiceAccount	Validate value
serverAppRegistrationClientId	serverAppRegistrationClientId	Validate value
sharePointSiteUrl	sharePointSiteUrl	Validate value
teamsAppId	-	New variable Id of the teams app from teams manifest.json (aka 'External app ID' in Microsoft Teams admin centre)
tenantId	tenantIdsForAuth	Rename variable name, validate value
topHeaderBannerText	-	New variable Top header banner text. For example `TEST environment` or empty for PROD

Save the changes.

Update 'Deploy Brief Connect Azure Resources' release pipeline

You can find the release pipeline in Brief Connect project - Pipelines - Releases

Clone existing release pipeline and keep a copy of it until the deployment is completed to all environments as a backup.
Open the release pipeline, open 3-dots menu, and select Clone option.
Update the name of the cloned pipeline and save it.
Go to the original release pipeline (not the copy created) and edit it. Remove existing build artifacts
Add new Artifact:
Source type: Azure Repos Git
Project: Brief Connect
Source (repository): Brief Connect - Azure Resources
Default branch: main
Default version: Latest from the default branch
Source alias: _AzureResources
The rest keep as-is with default values
Update tasks for each environment:
Delete Extract files task

Update Bicep param file task:

Working Directory: $(System.DefaultWorkingDirectory)/_AzureResources/Bicep

Script:

Update redisCacheSku param with existing provisioned configuration (was hardcoded in bicep template or in param file)
Update functionAppServicePlan, userAssignedIdentityName with existing provisioned resources for this environment
Set logAnalyticsWorkspaceName with existing resource name (Log Analytics Workspace associated with Application Insights resource)
Set storageAccountFuncName with value (New resource will be created with this name)
Validate all remaining params that they match existing resource names
Update apiAppServicePlan to name: 'B1' and tier: 'Basic' values or higher.

$file_content = @"
using './main.bicep'

var main_prefix = '${ENV:azureResourcesNamePrefix}'
param region = '${ENV:azureRegion}'
param authorizedGroupId = '${ENV:authorizedGroupId}'
param authorizedGroupName = '${ENV:authorizedGroupName}'
param serverAppRegistrationClientId = '${ENV:serverAppRegistrationClientId}'
param clientAppRegistrationClientId = '${ENV:clientAppRegistrationClientId}'
param m365tenantId = '${ENV:tenantId}'
param sharePointSiteUrl = '${ENV:sharePointSiteUrl}'

param redisCacheSku = {
name: 'Basic'
family: 'C'
capacity: 0
}

param apiServicePlanName = 'apip-`${main_prefix}'
param apiAppServicePlan = {
name: 'B1'
tier: 'Basic'
}

param functionAppServicePlanName =  'pfa-ap-`${main_prefix}'
param functionAppServicePlan = {
name: 'EP1'
tier: 'ElasticPremium'
}

param redisInstanceName = 'rc-`${main_prefix}'
param userAssignedIdentityName = 'briefconnect-managed-identity-test'
param apiAppName = 'api-`${main_prefix}'
param functionAppName = 'func-`${main_prefix}'
param keyVaultName = 'kv-`${main_prefix}'
param logAnalyticsWorkspaceName = 'managed-ai-`${main_prefix}-ws'
param applicationInsightsName = 'ai-`${main_prefix}'

param storageAccountWebName = '${ENV:azureStorageAccountWebName}'
param storageAccountFuncName = 'stasydsharedtstbcfunc'
param storageAccountDataName = '${ENV:azureStorageAccountDataName}'
param cosmosDbAccountName = 'cdb-`${toLower(main_prefix)}'
"@

$file_content | Out-File -FilePath "parameters.bicepparam" -Encoding utf8

#prints the content of the file
Get-Content -Path "parameters.bicepparam"

Update Azure CLI task:
- Inline Script: az deployment group create --resource-group "$(azureResourceGroupName)" --template-file main.bicep --parameters parameters.bicepparam
- Working Directory: $(System.DefaultWorkingDirectory)/_AzureResources/Bicep
Save the updated pipeline.

Update 'Deploy Brief Connect App and Config' release pipeline

You can find the release pipeline in Brief Connect project - Pipelines - Releases

Clone existing release pipeline and keep a copy of it until the deployment is completed to all environments as a backup.
Open the release pipeline, open 3-dots menu, and select Clone option.
Update the name of the cloned pipeline and save it.
Go to Variables section
Delete all existing pipeline variables
Add new pipeline variable:
- Name: Package Version
- Value: empty
- Scope: Release
- Settable at release time: Yes
In Variables groups section, link all variable groups to related environments (TEST to TEST, UAT to UAT, etc.)
Options tab - Release name format: set the value to v$(Package Version) ($(rev:r))
Update Validate package versions task

Script:

$packageVersion = "$(Package Version)";

if (!$packageVersion -or ($packageVersion -eq "*"))
{
   Write-Error "Please specify correct version for the package"
}

Update Download Client task
Version: $(Package Version)
Update Download Server task
Version: $(Package Version)
Update Server: Backend API task:
App settings (under Application and Configuration Settings): set it blank
Add new task after Server: Backend API:
Type: Azure App Service Settings
Display name: Server: Backend API Config
Azure subscription: select same service connection as in Server: Backend API task
App Service name: select same function app as in Server: Backend API task
Resource group: select resource group where the app is hosted
Slot: leave value by default

App Settings:

[
   {
   "name": "TopHeaderBannerText",
   "value": "$(topHeaderBannerText)",
   "slotSetting": false
   },
   {
   "name": "AppUrl",
   "value": "https://$(applicationDomainName)",
   "slotSetting": false
   },
   {
   "name": "AppName",
   "value": "$(applicationName)",
   "slotSetting": false
   }
]

Update Server: External API task
App settings (under Application and Configuration Settings): -AppUrl "https://$(applicationDomainName)"
Update Client: Create environment config file task

Script:

'{
    "tenantId": "$(tenantId)",
    "clientId": "$(clientAppRegistrationClientId)",
    "apiScope": "api://$(applicationDomainName)/$(serverAppRegistrationClientId)/access_as_user",
    "baseUrl": "https://$(azureFunctionDomainName)"
}'| Out-File "$(System.DefaultWorkingDirectory)/web/config.json" -Encoding utf8 -Force

Update Client: Deploy static CDN files task
Display name: Client: Deploy static files

Inline script

[CmdletBinding()]
Param(
   [string]$storageAccountName,
   [string]$workingDirectory
)

Write-Host ""
Write-Host "DELETE OLD FILES"
Write-Host ""
az storage blob delete-batch --source `$`web --account-name $storageAccountName

Write-Host ""
Write-Host "UPLOAD NEW FILES"
Write-Host ""
az storage blob upload-batch --source $workingDirectory/web --destination `$`web --account-name $storageAccountName

Script Arguments: -storageAccountName $(azureStorageAccountWebName) -workingDirectory $(System.DefaultWorkingDirectory)

5. Update Entra ID app registrations

Update Entra ID app registrations

Role required: Brief Connect Entra ID App Registration Owner (assigned Owner role for all 3 app registrations) or higher

Execute "2.13 Update Entra ID Apps" step from the deployment guide. Leave all optional parameters for UpdateAppRegistrations.ps1 script empty, set values only for required params.
Open Brief Connect Client application registration and update Authentication settings:
Uncheck all token options and save the changes. If it asks a confirmation to disable implicit flow - confirm to disable it.

Open Brief Connect Server application registration and update Authentication settings:
Uncheck all token options.
Remove all platforms from Platform configurations section.
Save the changes. If it asks a confirmation to disable implicit flow - confirm to disable it.

Grant Entra ID app permissions

Role required: Global Administrator

Execute next step for all application registrations (Client, Server, DevOps)

Execute "2.14 Grant Admin Consent" step from the deployment guide.

After granting admin consent for configured permissions, remove all permissions from "Other permissions granted for..." section.

==image_0==.png

6. Update Azure Resources

Key Vault permissions update

Open Brief Connect Key Vault resource instance in Azure Portal
Go to Settings - Access Configuration
Change Permission model to * Azure role-based access control (recommended) value and save the changes.

7. Run 'Deploy Brief Connect Azure Resources' pipeline

Create a new release using latest infrastructure code and run the new release pipeline for a target stage.

8. Update Azure Resources

Key Vault certificate update

Open Brief Connect Key Vault resource instance in Azure Portal
Go to Access control and provide yourself Key Vault Administrator role
Go to Certificates, open existing certificate, open current version of the certificate and 'Download in PFX/PEM format' and save it locally.
Go back to Certificates page, and Import PFX/PEM certificate file from the previous step.
For the certificate name, set "BriefConnect-Server-App" value.
Soft-delete the old certificate (it can be restored during retention period)
Go to Access control and remove provided roles for the current account (if necessary)

9. Integration with Azure Front Door

Open Azure Front Door instance in Azure Portal
Apply settings from step 5 from section "2.12 Integration with existing Azure Front Door instance" of the deployment guide to the existing default origin group that was created by CDN profile migration. Make sure, that updated Host name and Origin host header values linked to the static website hosted by newly provisioned storage (see azureStorageAccountWebName variable).
Execute step 6 from section "2.12 Integration with existing Azure Front Door instance" of the deployment guide.
Apply settings from step 7 from section 2.12 of the deployment guide to the existing default origin route created by CDN profile migration, instead of creating one. Do not change domain association, keep it associated with 2 domains.
Execute steps 8-9 from section "2.12 Integration with existing Azure Front Door instance" of the deployment guide.
Open Brief Connect resource group, and go to Data Storage account (azureStorageAccountDataName variable name in DevOps library group)
Go to Data management - Static website, Disable static website and save the changes.

10. Run 2.2.19 release deployment guide

Go through 2.2.19 deployment guide and deploy it to the target environment.