Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Bicep resource definition
The configurationStores resource type can be deployed with operations that target:
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.AppConfiguration/configurationStores resource, add the following Bicep to your template.
resource symbolicname 'Microsoft.AppConfiguration/configurationStores@2025-06-01-preview' = {
scope: resourceSymbolicName or scope
identity: {
type: 'string'
userAssignedIdentities: {
{customized property}: {}
}
}
location: 'string'
name: 'string'
properties: {
azureFrontDoor: {
resourceId: 'string'
}
createMode: 'string'
dataPlaneProxy: {
authenticationMode: 'string'
privateLinkDelegation: 'string'
}
defaultKeyValueRevisionRetentionPeriodInSeconds: int
disableLocalAuth: bool
enablePurgeProtection: bool
encryption: {
keyVaultProperties: {
identityClientId: 'string'
keyIdentifier: 'string'
}
}
publicNetworkAccess: 'string'
softDeleteRetentionInDays: int
telemetry: {
resourceId: 'string'
}
}
sku: {
name: 'string'
}
tags: {
{customized property}: 'string'
}
}
Property Values
Microsoft.AppConfiguration/configurationStores
| Name | Description | Value |
|---|---|---|
| identity | The managed identity information, if configured. | ResourceIdentity |
| location | The geo-location where the resource lives | string (required) |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9_-]*$ (required) |
| properties | The properties of a configuration store. | ConfigurationStoreProperties |
| scope | Use when creating a resource at a scope that is different than the deployment scope. | Set this property to the symbolic name of a resource to apply the extension resource. |
| sku | The sku of the configuration store. | Sku (required) |
| tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
AzureFrontDoorProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of an Azure Front Door profile | string |
ConfigurationStoreProperties
| Name | Description | Value |
|---|---|---|
| azureFrontDoor | Property specifying the configuration of Azure Front Door for this configuration store | AzureFrontDoorProperties |
| createMode | Indicates whether the configuration store need to be recovered. | 'Default' 'Recover' |
| dataPlaneProxy | Property specifying the configuration of data plane proxy for Azure Resource Manager (ARM). | DataPlaneProxyProperties |
| defaultKeyValueRevisionRetentionPeriodInSeconds | The duration in seconds to retain new key value revisions. Defaults to 604800 (7 days) for Free SKU stores and 2592000 (30 days) for Standard SKU stores and Premium SKU stores. | int |
| disableLocalAuth | Disables all authentication methods other than AAD authentication. | bool |
| enablePurgeProtection | Property specifying whether protection against purge is enabled for this configuration store. | bool |
| encryption | The encryption settings of the configuration store. | EncryptionProperties |
| publicNetworkAccess | Control permission for data plane traffic coming from public networks while private endpoint is enabled. | 'Disabled' 'Enabled' |
| softDeleteRetentionInDays | The amount of time in days that the configuration store will be retained when it is soft deleted. | int |
| telemetry | Property specifying the configuration of telemetry for this configuration store | TelemetryProperties |
DataPlaneProxyProperties
| Name | Description | Value |
|---|---|---|
| authenticationMode | The data plane proxy authentication mode. This property manages the authentication mode of request to the data plane resources. | 'Local' 'Pass-through' |
| privateLinkDelegation | The data plane proxy private link delegation. This property manages if a request from delegated ARM private link is allowed when the data plane resource requires private link. | 'Disabled' 'Enabled' |
EncryptionProperties
| Name | Description | Value |
|---|---|---|
| keyVaultProperties | Key vault properties. | KeyVaultProperties |
KeyVaultProperties
| Name | Description | Value |
|---|---|---|
| identityClientId | The client id of the identity which will be used to access key vault. | string |
| keyIdentifier | The URI of the key vault key used to encrypt data. | string |
ResourceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of managed identity used. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user-assigned identities. The type 'None' will remove any identities. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user-assigned identities associated with the resource. The user-assigned identity dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ResourceIdentityUserAssignedIdentities |
ResourceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
Sku
| Name | Description | Value |
|---|---|---|
| name | The SKU name of the configuration store. | string (required) |
TelemetryProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of a resource enabling telemetry collection | string |
TrackedResourceTags
| Name | Description | Value |
|---|
UserIdentity
| Name | Description | Value |
|---|
Usage Examples
Azure Verified Modules
The following Azure Verified Modules can be used to deploy this resource type.
| Module | Description |
|---|---|
| App Configuration Store | AVM Resource Module for App Configuration Store |
Azure Quickstart Samples
The following Azure Quickstart templates contain Bicep samples for deploying this resource type.
| Bicep File | Description |
|---|---|
| Create an App Configuration Store | This template creates an Azure App Configuration store. |
| Create an App Configuration Store with Feature Flag | This template creates a new Azure App Configuration store with one feature flag. |
| Create an App Configuration Store with Feature Flag | This template creates a new Azure App Configuration store with one Key Vault reference. |
| Create an App Configuration Store with Outputs | This template creates a new Azure App Configuration store with two key-values. |
ARM template resource definition
The configurationStores resource type can be deployed with operations that target:
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.AppConfiguration/configurationStores resource, add the following JSON to your template.
{
"type": "Microsoft.AppConfiguration/configurationStores",
"apiVersion": "2025-06-01-preview",
"name": "string",
"identity": {
"type": "string",
"userAssignedIdentities": {
"{customized property}": {
}
}
},
"location": "string",
"properties": {
"azureFrontDoor": {
"resourceId": "string"
},
"createMode": "string",
"dataPlaneProxy": {
"authenticationMode": "string",
"privateLinkDelegation": "string"
},
"defaultKeyValueRevisionRetentionPeriodInSeconds": "int",
"disableLocalAuth": "bool",
"enablePurgeProtection": "bool",
"encryption": {
"keyVaultProperties": {
"identityClientId": "string",
"keyIdentifier": "string"
}
},
"publicNetworkAccess": "string",
"softDeleteRetentionInDays": "int",
"telemetry": {
"resourceId": "string"
}
},
"sku": {
"name": "string"
},
"tags": {
"{customized property}": "string"
}
}
Property Values
Microsoft.AppConfiguration/configurationStores
| Name | Description | Value |
|---|---|---|
| apiVersion | The api version | '2025-06-01-preview' |
| identity | The managed identity information, if configured. | ResourceIdentity |
| location | The geo-location where the resource lives | string (required) |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9_-]*$ (required) |
| properties | The properties of a configuration store. | ConfigurationStoreProperties |
| sku | The sku of the configuration store. | Sku (required) |
| tags | Resource tags | Dictionary of tag names and values. See Tags in templates |
| type | The resource type | 'Microsoft.AppConfiguration/configurationStores' |
AzureFrontDoorProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of an Azure Front Door profile | string |
ConfigurationStoreProperties
| Name | Description | Value |
|---|---|---|
| azureFrontDoor | Property specifying the configuration of Azure Front Door for this configuration store | AzureFrontDoorProperties |
| createMode | Indicates whether the configuration store need to be recovered. | 'Default' 'Recover' |
| dataPlaneProxy | Property specifying the configuration of data plane proxy for Azure Resource Manager (ARM). | DataPlaneProxyProperties |
| defaultKeyValueRevisionRetentionPeriodInSeconds | The duration in seconds to retain new key value revisions. Defaults to 604800 (7 days) for Free SKU stores and 2592000 (30 days) for Standard SKU stores and Premium SKU stores. | int |
| disableLocalAuth | Disables all authentication methods other than AAD authentication. | bool |
| enablePurgeProtection | Property specifying whether protection against purge is enabled for this configuration store. | bool |
| encryption | The encryption settings of the configuration store. | EncryptionProperties |
| publicNetworkAccess | Control permission for data plane traffic coming from public networks while private endpoint is enabled. | 'Disabled' 'Enabled' |
| softDeleteRetentionInDays | The amount of time in days that the configuration store will be retained when it is soft deleted. | int |
| telemetry | Property specifying the configuration of telemetry for this configuration store | TelemetryProperties |
DataPlaneProxyProperties
| Name | Description | Value |
|---|---|---|
| authenticationMode | The data plane proxy authentication mode. This property manages the authentication mode of request to the data plane resources. | 'Local' 'Pass-through' |
| privateLinkDelegation | The data plane proxy private link delegation. This property manages if a request from delegated ARM private link is allowed when the data plane resource requires private link. | 'Disabled' 'Enabled' |
EncryptionProperties
| Name | Description | Value |
|---|---|---|
| keyVaultProperties | Key vault properties. | KeyVaultProperties |
KeyVaultProperties
| Name | Description | Value |
|---|---|---|
| identityClientId | The client id of the identity which will be used to access key vault. | string |
| keyIdentifier | The URI of the key vault key used to encrypt data. | string |
ResourceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of managed identity used. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user-assigned identities. The type 'None' will remove any identities. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user-assigned identities associated with the resource. The user-assigned identity dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ResourceIdentityUserAssignedIdentities |
ResourceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
Sku
| Name | Description | Value |
|---|---|---|
| name | The SKU name of the configuration store. | string (required) |
TelemetryProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of a resource enabling telemetry collection | string |
TrackedResourceTags
| Name | Description | Value |
|---|
UserIdentity
| Name | Description | Value |
|---|
Usage Examples
Azure Quickstart Templates
The following Azure Quickstart templates deploy this resource type.
| Template | Description |
|---|---|
App Configuration Key-Values |
This template creates a new Azure App Configuration store with three key-values controlled by a copy function. |
| App Configuration with VM |
This template references existing key-value configurations from an existing config store and uses retrieved values to set properties of the resources the template creates. |
| Create an App Configuration Store |
This template creates an Azure App Configuration store. |
| Create an App Configuration Store with Feature Flag |
This template creates a new Azure App Configuration store with one feature flag. |
| Create an App Configuration Store with Feature Flag |
This template creates a new Azure App Configuration store with one Key Vault reference. |
| Create an App Configuration Store with Outputs |
This template creates a new Azure App Configuration store with two key-values. |
Terraform (AzAPI provider) resource definition
The configurationStores resource type can be deployed with operations that target:
For a list of changed properties in each API version, see change log.
Resource format
To create a Microsoft.AppConfiguration/configurationStores resource, add the following Terraform to your template.
resource "azapi_resource" "symbolicname" {
type = "Microsoft.AppConfiguration/configurationStores@2025-06-01-preview"
name = "string"
parent_id = "string"
identity {
type = "string"
identity_ids = [
"string"
]
}
location = "string"
tags = {
{customized property} = "string"
}
body = {
properties = {
azureFrontDoor = {
resourceId = "string"
}
createMode = "string"
dataPlaneProxy = {
authenticationMode = "string"
privateLinkDelegation = "string"
}
defaultKeyValueRevisionRetentionPeriodInSeconds = int
disableLocalAuth = bool
enablePurgeProtection = bool
encryption = {
keyVaultProperties = {
identityClientId = "string"
keyIdentifier = "string"
}
}
publicNetworkAccess = "string"
softDeleteRetentionInDays = int
telemetry = {
resourceId = "string"
}
}
sku = {
name = "string"
}
}
}
Property Values
Microsoft.AppConfiguration/configurationStores
| Name | Description | Value |
|---|---|---|
| identity | The managed identity information, if configured. | ResourceIdentity |
| location | The geo-location where the resource lives | string (required) |
| name | The resource name | string Constraints: Min length = 5 Max length = 50 Pattern = ^[a-zA-Z0-9_-]*$ (required) |
| parent_id | The ID of the resource to apply this extension resource to. | string (required) |
| properties | The properties of a configuration store. | ConfigurationStoreProperties |
| sku | The sku of the configuration store. | Sku (required) |
| tags | Resource tags | Dictionary of tag names and values. |
| type | The resource type | "Microsoft.AppConfiguration/configurationStores@2025-06-01-preview" |
AzureFrontDoorProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of an Azure Front Door profile | string |
ConfigurationStoreProperties
| Name | Description | Value |
|---|---|---|
| azureFrontDoor | Property specifying the configuration of Azure Front Door for this configuration store | AzureFrontDoorProperties |
| createMode | Indicates whether the configuration store need to be recovered. | 'Default' 'Recover' |
| dataPlaneProxy | Property specifying the configuration of data plane proxy for Azure Resource Manager (ARM). | DataPlaneProxyProperties |
| defaultKeyValueRevisionRetentionPeriodInSeconds | The duration in seconds to retain new key value revisions. Defaults to 604800 (7 days) for Free SKU stores and 2592000 (30 days) for Standard SKU stores and Premium SKU stores. | int |
| disableLocalAuth | Disables all authentication methods other than AAD authentication. | bool |
| enablePurgeProtection | Property specifying whether protection against purge is enabled for this configuration store. | bool |
| encryption | The encryption settings of the configuration store. | EncryptionProperties |
| publicNetworkAccess | Control permission for data plane traffic coming from public networks while private endpoint is enabled. | 'Disabled' 'Enabled' |
| softDeleteRetentionInDays | The amount of time in days that the configuration store will be retained when it is soft deleted. | int |
| telemetry | Property specifying the configuration of telemetry for this configuration store | TelemetryProperties |
DataPlaneProxyProperties
| Name | Description | Value |
|---|---|---|
| authenticationMode | The data plane proxy authentication mode. This property manages the authentication mode of request to the data plane resources. | 'Local' 'Pass-through' |
| privateLinkDelegation | The data plane proxy private link delegation. This property manages if a request from delegated ARM private link is allowed when the data plane resource requires private link. | 'Disabled' 'Enabled' |
EncryptionProperties
| Name | Description | Value |
|---|---|---|
| keyVaultProperties | Key vault properties. | KeyVaultProperties |
KeyVaultProperties
| Name | Description | Value |
|---|---|---|
| identityClientId | The client id of the identity which will be used to access key vault. | string |
| keyIdentifier | The URI of the key vault key used to encrypt data. | string |
ResourceIdentity
| Name | Description | Value |
|---|---|---|
| type | The type of managed identity used. The type 'SystemAssigned, UserAssigned' includes both an implicitly created identity and a set of user-assigned identities. The type 'None' will remove any identities. | 'None' 'SystemAssigned' 'SystemAssigned, UserAssigned' 'UserAssigned' |
| userAssignedIdentities | The list of user-assigned identities associated with the resource. The user-assigned identity dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}'. | ResourceIdentityUserAssignedIdentities |
ResourceIdentityUserAssignedIdentities
| Name | Description | Value |
|---|
Sku
| Name | Description | Value |
|---|---|---|
| name | The SKU name of the configuration store. | string (required) |
TelemetryProperties
| Name | Description | Value |
|---|---|---|
| resourceId | Resource ID of a resource enabling telemetry collection | string |
TrackedResourceTags
| Name | Description | Value |
|---|
UserIdentity
| Name | Description | Value |
|---|
Usage Examples
Terraform Samples
A basic example of deploying Azure App Configuration.
terraform {
required_providers {
azapi = {
source = "Azure/azapi"
}
}
}
provider "azapi" {
skip_provider_registration = false
}
variable "resource_name" {
type = string
default = "acctest0001"
}
variable "location" {
type = string
default = "westeurope"
}
resource "azapi_resource" "resourceGroup" {
type = "Microsoft.Resources/resourceGroups@2020-06-01"
name = var.resource_name
location = var.location
}
resource "azapi_resource" "configurationStore" {
type = "Microsoft.AppConfiguration/configurationStores@2023-03-01"
parent_id = azapi_resource.resourceGroup.id
name = var.resource_name
location = var.location
body = {
properties = {
disableLocalAuth = false
enablePurgeProtection = false
}
sku = {
name = "standard"
}
}
schema_validation_enabled = false
response_export_values = ["*"]
}
Azure Verified Modules
The following Azure Verified Modules can be used to deploy this resource type.
| Module | Description |
|---|---|
| App Configuration Store | AVM Resource Module for App Configuration Store |