Microsoft.Mission virtualEnclaves

Bicep resource definition

The virtualEnclaves resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands

For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Mission/virtualEnclaves resource, add the following Bicep to your template.

resource symbolicname 'Microsoft.Mission/virtualEnclaves@2026-04-01' = {
  identity: {
    type: 'string'
    userAssignedIdentities: {
      {customized property}: {}
    }
  }
  location: 'string'
  name: 'string'
  properties: {
    approvalSettings: {
      connectionCreation: {
        approvalPolicy: 'string'
        mandatoryApprovers: [
          {
            approverEntraId: 'string'
          }
        ]
        minimumApproversRequired: int
      }
      connectionUpdate: {
        approvalPolicy: 'string'
        mandatoryApprovers: [
          {
            approverEntraId: 'string'
          }
        ]
        minimumApproversRequired: int
      }
      enclaveEndpointUpdate: {
        approvalPolicy: 'string'
        mandatoryApprovers: [
          {
            approverEntraId: 'string'
          }
        ]
        minimumApproversRequired: int
      }
      enclaveMaintenanceMode: {
        approvalPolicy: 'string'
        mandatoryApprovers: [
          {
            approverEntraId: 'string'
          }
        ]
        minimumApproversRequired: int
      }
    }
    bastionEnabled: bool
    communityResourceId: 'string'
    dedicatedHubResourceId: 'string'
    enclaveDefaultSettings: {
      diagnosticDestination: 'string'
    }
    enclaveRoleAssignments: [
      {
        condition: 'string'
        principals: [
          {
            id: 'string'
            type: 'string'
          }
        ]
        roleDefinitionId: 'string'
      }
    ]
    enclaveVirtualNetwork: {
      allowSubnetCommunication: bool
      customCidrRange: 'string'
      networkName: 'string'
      networkSize: 'string'
      subnetConfigurations: [
        {
          networkPrefixSize: int
          subnetDelegation: 'string'
          subnetName: 'string'
        }
      ]
    }
    governedServiceList: [
      {
        enforcement: 'string'
        option: 'string'
        policyAction: 'string'
        serviceId: 'string'
      }
    ]
    maintenanceModeConfiguration: {
      justification: 'string'
      mode: 'string'
      principals: [
        {
          id: 'string'
          type: 'string'
        }
      ]
    }
    monitoringSettings: {
      diagnosticDestinations: [
        {
          customWorkspaceResourceId: 'string'
          destinationType: 'string'
          diagnosticSettingsName: 'string'
        }
      ]
      flowLogDestination: {
        customWorkspaceResourceId: 'string'
        destinationType: 'string'
        diagnosticSettingsName: 'string'
      }
    }
    rbacInheritance: 'string'
    workloadResourceVisibility: 'string'
    workloadRoleAssignments: [
      {
        condition: 'string'
        principals: [
          {
            id: 'string'
            type: 'string'
          }
        ]
        roleDefinitionId: 'string'
      }
    ]
  }
  tags: {
    {customized property}: 'string'
  }
}

Property Values

Microsoft.Mission/virtualEnclaves

Name	Description	Value
identity	The managed service identities assigned to this resource.	ManagedServiceIdentity
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[a-zA-Z][a-zA-Z0-9-]*[a-zA-Z0-9]$` (required)
properties	The resource-specific properties for this resource.	VirtualEnclaveProperties
tags	Resource tags	Dictionary of tag names and values. See Tags in templates

ApprovalSettingConfiguration

Name	Description	Value
approvalPolicy	Approval policy (Required or NotRequired).	'NotRequired' 'Required'
mandatoryApprovers	List of mandatory approvers for this approval setting.	MandatoryApprover[]
minimumApproversRequired	Minimum number of approvers required for this approval setting.	int Constraints: Min value = 0

EnclaveDefaultSettingsModel

Name	Description	Value
diagnosticDestination	Diagnostic Destination.	'Both' 'CommunityOnly' 'EnclaveOnly'

EnclaveVirtualNetworkModel

Name	Description	Value
allowSubnetCommunication	Allow Subnet Communication.	bool
customCidrRange	Custom CIDR Range.	string
networkName	Network Name.	string
networkSize	Network Size.	string
subnetConfigurations	Subnet Configurations.	SubnetConfiguration[]

GovernedServiceItem

Name	Description	Value
enforcement	Initiative enforcement (Enabled or Disabled).	'Disabled' 'Enabled'
option	Governance option for this service (Allow, Deny, ExceptionOnly, or NotApplicable).	'Allow' 'Deny' 'ExceptionOnly' 'NotApplicable'
policyAction	Enforcement mode for policy. AuditOnly, Enforce, or None.	'AuditOnly' 'Enforce' 'None'
serviceId	Service ID	'AKS' 'AppService' 'AzureFirewalls' 'ContainerRegistry' 'CosmosDB' 'DataConnectors' 'Insights' 'KeyVault' 'Logic' 'MicrosoftSQL' 'Monitoring' 'PostgreSQL' 'PrivateDNSZones' 'ServiceBus' 'Storage' (required)

MaintenanceModeConfigurationModel

Name	Description	Value
justification	Justification for entering or exiting Maintenance Mode	'Governance' 'Networking' 'Off'
mode	Current mode of Maintenance Mode Configuration	'Advanced' 'CanNotDelete' 'General' 'Off' 'On' (required)
principals	The user, group or service principal object affected by Maintenance Mode	Principal[]

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

MandatoryApprover

Name	Description	Value
approverEntraId	EntraId of the approver	string (required)

MonitoringDestination

Name	Description	Value
customWorkspaceResourceId	Log analytics workspace resource ID for custom workspace	string
destinationType	The type of monitoring workspace destination	'CommunityWorkspace' 'CustomWorkspace' 'EnclaveWorkspace' (required)
diagnosticSettingsName	Custom name for diagnostic settings	string

MonitoringSettingsModel

Name	Description	Value
diagnosticDestinations	Log Analytics workspace destinations where diagnostic logs will be stored.	MonitoringDestination[]
flowLogDestination	Log Analytics workspace destination where virtual network flow logs will be stored.	MonitoringDestination

Principal

Name	Description	Value
id	The object id associated with the principal	string (required)
type	The type of the object id. We currently allow users, groups, and service principals	'Group' 'ServicePrincipal' 'User' (required)

RoleAssignmentItem

Name	Description	Value
condition	Condition under which the principal can be granted permission	string
principals	List of principal IDs to which to assign this role definition	Principal[]
roleDefinitionId	Role definition identifier	string (required)

SubnetConfiguration

Name	Description	Value
networkPrefixSize	Network prefix size.	int (required)
subnetDelegation	Subnet delegation.	string
subnetName	Subnet name.	string (required)

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

VirtualEnclaveApprovalSettings

Name	Description	Value
connectionCreation	Approval configuration for connection creation.	ApprovalSettingConfiguration
connectionUpdate	Approval configuration for connection updates.	ApprovalSettingConfiguration
enclaveEndpointUpdate	Approval configuration for enclave endpoint updates.	ApprovalSettingConfiguration
enclaveMaintenanceMode	Approval configuration for enclave maintenance mode.	ApprovalSettingConfiguration

VirtualEnclaveProperties

Name	Description	Value
approvalSettings	Approval requirements for various actions on the enclave's resources.	VirtualEnclaveApprovalSettings
bastionEnabled	Deploy Bastion service (True or False).	bool
communityResourceId	Community Resource Id.	string (required)
dedicatedHubResourceId	DedicatedHub Resource ID.	string
enclaveDefaultSettings	Enclave default settings.	EnclaveDefaultSettingsModel
enclaveRoleAssignments	Enclave role assignments	RoleAssignmentItem[]
enclaveVirtualNetwork	Virtual Network.	EnclaveVirtualNetworkModel (required)
governedServiceList	Enclave specific policies	GovernedServiceItem[]
maintenanceModeConfiguration	Maintenance Mode configuration.	MaintenanceModeConfigurationModel
monitoringSettings	Virtual Enclave Monitoring Settings for diagnostic and virtual network flow logs	MonitoringSettingsModel
rbacInheritance	Controls whether standard Azure RBAC role inheritance applies to the workload resource group(s)	'Disabled' 'Enabled'
workloadResourceVisibility	Specifies whether resources in the workload resource group(s) are visible through standard RBAC	'Disabled' 'Enabled'
workloadRoleAssignments	Workload role assignments	RoleAssignmentItem[]

ARM template resource definition

The virtualEnclaves resource type can be deployed with operations that target:

Resource groups - See resource group deployment commands For a list of changed properties in each API version, see change log.

Usage Examples

Resource format

To create a Microsoft.Mission/virtualEnclaves resource, add the following JSON to your template.

{
  "type": "Microsoft.Mission/virtualEnclaves",
  "apiVersion": "2026-04-01",
  "name": "string",
  "identity": {
    "type": "string",
    "userAssignedIdentities": {
      "{customized property}": {
      }
    }
  },
  "location": "string",
  "properties": {
    "approvalSettings": {
      "connectionCreation": {
        "approvalPolicy": "string",
        "mandatoryApprovers": [
          {
            "approverEntraId": "string"
          }
        ],
        "minimumApproversRequired": "int"
      },
      "connectionUpdate": {
        "approvalPolicy": "string",
        "mandatoryApprovers": [
          {
            "approverEntraId": "string"
          }
        ],
        "minimumApproversRequired": "int"
      },
      "enclaveEndpointUpdate": {
        "approvalPolicy": "string",
        "mandatoryApprovers": [
          {
            "approverEntraId": "string"
          }
        ],
        "minimumApproversRequired": "int"
      },
      "enclaveMaintenanceMode": {
        "approvalPolicy": "string",
        "mandatoryApprovers": [
          {
            "approverEntraId": "string"
          }
        ],
        "minimumApproversRequired": "int"
      }
    },
    "bastionEnabled": "bool",
    "communityResourceId": "string",
    "dedicatedHubResourceId": "string",
    "enclaveDefaultSettings": {
      "diagnosticDestination": "string"
    },
    "enclaveRoleAssignments": [
      {
        "condition": "string",
        "principals": [
          {
            "id": "string",
            "type": "string"
          }
        ],
        "roleDefinitionId": "string"
      }
    ],
    "enclaveVirtualNetwork": {
      "allowSubnetCommunication": "bool",
      "customCidrRange": "string",
      "networkName": "string",
      "networkSize": "string",
      "subnetConfigurations": [
        {
          "networkPrefixSize": "int",
          "subnetDelegation": "string",
          "subnetName": "string"
        }
      ]
    },
    "governedServiceList": [
      {
        "enforcement": "string",
        "option": "string",
        "policyAction": "string",
        "serviceId": "string"
      }
    ],
    "maintenanceModeConfiguration": {
      "justification": "string",
      "mode": "string",
      "principals": [
        {
          "id": "string",
          "type": "string"
        }
      ]
    },
    "monitoringSettings": {
      "diagnosticDestinations": [
        {
          "customWorkspaceResourceId": "string",
          "destinationType": "string",
          "diagnosticSettingsName": "string"
        }
      ],
      "flowLogDestination": {
        "customWorkspaceResourceId": "string",
        "destinationType": "string",
        "diagnosticSettingsName": "string"
      }
    },
    "rbacInheritance": "string",
    "workloadResourceVisibility": "string",
    "workloadRoleAssignments": [
      {
        "condition": "string",
        "principals": [
          {
            "id": "string",
            "type": "string"
          }
        ],
        "roleDefinitionId": "string"
      }
    ]
  },
  "tags": {
    "{customized property}": "string"
  }
}

Property Values

Microsoft.Mission/virtualEnclaves

Name	Description	Value
apiVersion	The api version	'2026-04-01'
identity	The managed service identities assigned to this resource.	ManagedServiceIdentity
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[a-zA-Z][a-zA-Z0-9-]*[a-zA-Z0-9]$` (required)
properties	The resource-specific properties for this resource.	VirtualEnclaveProperties
tags	Resource tags	Dictionary of tag names and values. See Tags in templates
type	The resource type	'Microsoft.Mission/virtualEnclaves'

ApprovalSettingConfiguration

Name	Description	Value
approvalPolicy	Approval policy (Required or NotRequired).	'NotRequired' 'Required'
mandatoryApprovers	List of mandatory approvers for this approval setting.	MandatoryApprover[]
minimumApproversRequired	Minimum number of approvers required for this approval setting.	int Constraints: Min value = 0

EnclaveDefaultSettingsModel

Name	Description	Value
diagnosticDestination	Diagnostic Destination.	'Both' 'CommunityOnly' 'EnclaveOnly'

EnclaveVirtualNetworkModel

Name	Description	Value
allowSubnetCommunication	Allow Subnet Communication.	bool
customCidrRange	Custom CIDR Range.	string
networkName	Network Name.	string
networkSize	Network Size.	string
subnetConfigurations	Subnet Configurations.	SubnetConfiguration[]

GovernedServiceItem

Name	Description	Value
enforcement	Initiative enforcement (Enabled or Disabled).	'Disabled' 'Enabled'
option	Governance option for this service (Allow, Deny, ExceptionOnly, or NotApplicable).	'Allow' 'Deny' 'ExceptionOnly' 'NotApplicable'
policyAction	Enforcement mode for policy. AuditOnly, Enforce, or None.	'AuditOnly' 'Enforce' 'None'
serviceId	Service ID	'AKS' 'AppService' 'AzureFirewalls' 'ContainerRegistry' 'CosmosDB' 'DataConnectors' 'Insights' 'KeyVault' 'Logic' 'MicrosoftSQL' 'Monitoring' 'PostgreSQL' 'PrivateDNSZones' 'ServiceBus' 'Storage' (required)

MaintenanceModeConfigurationModel

Name	Description	Value
justification	Justification for entering or exiting Maintenance Mode	'Governance' 'Networking' 'Off'
mode	Current mode of Maintenance Mode Configuration	'Advanced' 'CanNotDelete' 'General' 'Off' 'On' (required)
principals	The user, group or service principal object affected by Maintenance Mode	Principal[]

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

MandatoryApprover

Name	Description	Value
approverEntraId	EntraId of the approver	string (required)

MonitoringDestination

Name	Description	Value
customWorkspaceResourceId	Log analytics workspace resource ID for custom workspace	string
destinationType	The type of monitoring workspace destination	'CommunityWorkspace' 'CustomWorkspace' 'EnclaveWorkspace' (required)
diagnosticSettingsName	Custom name for diagnostic settings	string

MonitoringSettingsModel

Name	Description	Value
diagnosticDestinations	Log Analytics workspace destinations where diagnostic logs will be stored.	MonitoringDestination[]
flowLogDestination	Log Analytics workspace destination where virtual network flow logs will be stored.	MonitoringDestination

Principal

Name	Description	Value
id	The object id associated with the principal	string (required)
type	The type of the object id. We currently allow users, groups, and service principals	'Group' 'ServicePrincipal' 'User' (required)

RoleAssignmentItem

Name	Description	Value
condition	Condition under which the principal can be granted permission	string
principals	List of principal IDs to which to assign this role definition	Principal[]
roleDefinitionId	Role definition identifier	string (required)

SubnetConfiguration

Name	Description	Value
networkPrefixSize	Network prefix size.	int (required)
subnetDelegation	Subnet delegation.	string
subnetName	Subnet name.	string (required)

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

VirtualEnclaveApprovalSettings

Name	Description	Value
connectionCreation	Approval configuration for connection creation.	ApprovalSettingConfiguration
connectionUpdate	Approval configuration for connection updates.	ApprovalSettingConfiguration
enclaveEndpointUpdate	Approval configuration for enclave endpoint updates.	ApprovalSettingConfiguration
enclaveMaintenanceMode	Approval configuration for enclave maintenance mode.	ApprovalSettingConfiguration

VirtualEnclaveProperties

Name	Description	Value
approvalSettings	Approval requirements for various actions on the enclave's resources.	VirtualEnclaveApprovalSettings
bastionEnabled	Deploy Bastion service (True or False).	bool
communityResourceId	Community Resource Id.	string (required)
dedicatedHubResourceId	DedicatedHub Resource ID.	string
enclaveDefaultSettings	Enclave default settings.	EnclaveDefaultSettingsModel
enclaveRoleAssignments	Enclave role assignments	RoleAssignmentItem[]
enclaveVirtualNetwork	Virtual Network.	EnclaveVirtualNetworkModel (required)
governedServiceList	Enclave specific policies	GovernedServiceItem[]
maintenanceModeConfiguration	Maintenance Mode configuration.	MaintenanceModeConfigurationModel
monitoringSettings	Virtual Enclave Monitoring Settings for diagnostic and virtual network flow logs	MonitoringSettingsModel
rbacInheritance	Controls whether standard Azure RBAC role inheritance applies to the workload resource group(s)	'Disabled' 'Enabled'
workloadResourceVisibility	Specifies whether resources in the workload resource group(s) are visible through standard RBAC	'Disabled' 'Enabled'
workloadRoleAssignments	Workload role assignments	RoleAssignmentItem[]

Terraform (AzAPI provider) resource definition

The virtualEnclaves resource type can be deployed with operations that target:

Resource groups For a list of changed properties in each API version, see change log.

Resource format

To create a Microsoft.Mission/virtualEnclaves resource, add the following Terraform to your template.

resource "azapi_resource" "symbolicname" {
  type = "Microsoft.Mission/virtualEnclaves@2026-04-01"
  name = "string"
  parent_id = "string"
  identity {
    type = "string"
    identity_ids = [
      "string"
    ]
  }
  location = "string"
  tags = {
    {customized property} = "string"
  }
  body = {
    properties = {
      approvalSettings = {
        connectionCreation = {
          approvalPolicy = "string"
          mandatoryApprovers = [
            {
              approverEntraId = "string"
            }
          ]
          minimumApproversRequired = int
        }
        connectionUpdate = {
          approvalPolicy = "string"
          mandatoryApprovers = [
            {
              approverEntraId = "string"
            }
          ]
          minimumApproversRequired = int
        }
        enclaveEndpointUpdate = {
          approvalPolicy = "string"
          mandatoryApprovers = [
            {
              approverEntraId = "string"
            }
          ]
          minimumApproversRequired = int
        }
        enclaveMaintenanceMode = {
          approvalPolicy = "string"
          mandatoryApprovers = [
            {
              approverEntraId = "string"
            }
          ]
          minimumApproversRequired = int
        }
      }
      bastionEnabled = bool
      communityResourceId = "string"
      dedicatedHubResourceId = "string"
      enclaveDefaultSettings = {
        diagnosticDestination = "string"
      }
      enclaveRoleAssignments = [
        {
          condition = "string"
          principals = [
            {
              id = "string"
              type = "string"
            }
          ]
          roleDefinitionId = "string"
        }
      ]
      enclaveVirtualNetwork = {
        allowSubnetCommunication = bool
        customCidrRange = "string"
        networkName = "string"
        networkSize = "string"
        subnetConfigurations = [
          {
            networkPrefixSize = int
            subnetDelegation = "string"
            subnetName = "string"
          }
        ]
      }
      governedServiceList = [
        {
          enforcement = "string"
          option = "string"
          policyAction = "string"
          serviceId = "string"
        }
      ]
      maintenanceModeConfiguration = {
        justification = "string"
        mode = "string"
        principals = [
          {
            id = "string"
            type = "string"
          }
        ]
      }
      monitoringSettings = {
        diagnosticDestinations = [
          {
            customWorkspaceResourceId = "string"
            destinationType = "string"
            diagnosticSettingsName = "string"
          }
        ]
        flowLogDestination = {
          customWorkspaceResourceId = "string"
          destinationType = "string"
          diagnosticSettingsName = "string"
        }
      }
      rbacInheritance = "string"
      workloadResourceVisibility = "string"
      workloadRoleAssignments = [
        {
          condition = "string"
          principals = [
            {
              id = "string"
              type = "string"
            }
          ]
          roleDefinitionId = "string"
        }
      ]
    }
  }
}

Property Values

Microsoft.Mission/virtualEnclaves

Name	Description	Value
identity	The managed service identities assigned to this resource.	ManagedServiceIdentity
location	The geo-location where the resource lives	string (required)
name	The resource name	string Constraints: Pattern = `^[a-zA-Z][a-zA-Z0-9-]*[a-zA-Z0-9]$` (required)
properties	The resource-specific properties for this resource.	VirtualEnclaveProperties
tags	Resource tags	Dictionary of tag names and values.
type	The resource type	"Microsoft.Mission/virtualEnclaves@2026-04-01"

ApprovalSettingConfiguration

Name	Description	Value
approvalPolicy	Approval policy (Required or NotRequired).	'NotRequired' 'Required'
mandatoryApprovers	List of mandatory approvers for this approval setting.	MandatoryApprover[]
minimumApproversRequired	Minimum number of approvers required for this approval setting.	int Constraints: Min value = 0

EnclaveDefaultSettingsModel

Name	Description	Value
diagnosticDestination	Diagnostic Destination.	'Both' 'CommunityOnly' 'EnclaveOnly'

EnclaveVirtualNetworkModel

Name	Description	Value
allowSubnetCommunication	Allow Subnet Communication.	bool
customCidrRange	Custom CIDR Range.	string
networkName	Network Name.	string
networkSize	Network Size.	string
subnetConfigurations	Subnet Configurations.	SubnetConfiguration[]

GovernedServiceItem

Name	Description	Value
enforcement	Initiative enforcement (Enabled or Disabled).	'Disabled' 'Enabled'
option	Governance option for this service (Allow, Deny, ExceptionOnly, or NotApplicable).	'Allow' 'Deny' 'ExceptionOnly' 'NotApplicable'
policyAction	Enforcement mode for policy. AuditOnly, Enforce, or None.	'AuditOnly' 'Enforce' 'None'
serviceId	Service ID	'AKS' 'AppService' 'AzureFirewalls' 'ContainerRegistry' 'CosmosDB' 'DataConnectors' 'Insights' 'KeyVault' 'Logic' 'MicrosoftSQL' 'Monitoring' 'PostgreSQL' 'PrivateDNSZones' 'ServiceBus' 'Storage' (required)

MaintenanceModeConfigurationModel

Name	Description	Value
justification	Justification for entering or exiting Maintenance Mode	'Governance' 'Networking' 'Off'
mode	Current mode of Maintenance Mode Configuration	'Advanced' 'CanNotDelete' 'General' 'Off' 'On' (required)
principals	The user, group or service principal object affected by Maintenance Mode	Principal[]

ManagedServiceIdentity

Name	Description	Value
type	Type of managed service identity (where both SystemAssigned and UserAssigned types are allowed).	'None' 'SystemAssigned' 'SystemAssigned,UserAssigned' 'UserAssigned' (required)
userAssignedIdentities	The set of user assigned identities associated with the resource. The userAssignedIdentities dictionary keys will be ARM resource ids in the form: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}. The dictionary values can be empty objects ({}) in requests.	UserAssignedIdentities

MandatoryApprover

Name	Description	Value
approverEntraId	EntraId of the approver	string (required)

MonitoringDestination

Name	Description	Value
customWorkspaceResourceId	Log analytics workspace resource ID for custom workspace	string
destinationType	The type of monitoring workspace destination	'CommunityWorkspace' 'CustomWorkspace' 'EnclaveWorkspace' (required)
diagnosticSettingsName	Custom name for diagnostic settings	string

MonitoringSettingsModel

Name	Description	Value
diagnosticDestinations	Log Analytics workspace destinations where diagnostic logs will be stored.	MonitoringDestination[]
flowLogDestination	Log Analytics workspace destination where virtual network flow logs will be stored.	MonitoringDestination

Principal

Name	Description	Value
id	The object id associated with the principal	string (required)
type	The type of the object id. We currently allow users, groups, and service principals	'Group' 'ServicePrincipal' 'User' (required)

RoleAssignmentItem

Name	Description	Value
condition	Condition under which the principal can be granted permission	string
principals	List of principal IDs to which to assign this role definition	Principal[]
roleDefinitionId	Role definition identifier	string (required)

SubnetConfiguration

Name	Description	Value
networkPrefixSize	Network prefix size.	int (required)
subnetDelegation	Subnet delegation.	string
subnetName	Subnet name.	string (required)

TrackedResourceTags

Name	Description	Value

UserAssignedIdentities

Name	Description	Value

UserAssignedIdentity

Name	Description	Value

VirtualEnclaveApprovalSettings

Name	Description	Value
connectionCreation	Approval configuration for connection creation.	ApprovalSettingConfiguration
connectionUpdate	Approval configuration for connection updates.	ApprovalSettingConfiguration
enclaveEndpointUpdate	Approval configuration for enclave endpoint updates.	ApprovalSettingConfiguration
enclaveMaintenanceMode	Approval configuration for enclave maintenance mode.	ApprovalSettingConfiguration

VirtualEnclaveProperties

Name	Description	Value
approvalSettings	Approval requirements for various actions on the enclave's resources.	VirtualEnclaveApprovalSettings
bastionEnabled	Deploy Bastion service (True or False).	bool
communityResourceId	Community Resource Id.	string (required)
dedicatedHubResourceId	DedicatedHub Resource ID.	string
enclaveDefaultSettings	Enclave default settings.	EnclaveDefaultSettingsModel
enclaveRoleAssignments	Enclave role assignments	RoleAssignmentItem[]
enclaveVirtualNetwork	Virtual Network.	EnclaveVirtualNetworkModel (required)
governedServiceList	Enclave specific policies	GovernedServiceItem[]
maintenanceModeConfiguration	Maintenance Mode configuration.	MaintenanceModeConfigurationModel
monitoringSettings	Virtual Enclave Monitoring Settings for diagnostic and virtual network flow logs	MonitoringSettingsModel
rbacInheritance	Controls whether standard Azure RBAC role inheritance applies to the workload resource group(s)	'Disabled' 'Enabled'
workloadResourceVisibility	Specifies whether resources in the workload resource group(s) are visible through standard RBAC	'Disabled' 'Enabled'
workloadRoleAssignments	Workload role assignments	RoleAssignmentItem[]

Feedback

Was this page helpful?

Last updated on 2026-07-06

Microsoft.Mission virtualEnclaves

Bicep resource definition

Resource format

Property Values

Microsoft.Mission/virtualEnclaves

ApprovalSettingConfiguration

EnclaveDefaultSettingsModel

EnclaveVirtualNetworkModel

GovernedServiceItem

MaintenanceModeConfigurationModel

ManagedServiceIdentity

MandatoryApprover

MonitoringDestination

MonitoringSettingsModel

Principal

RoleAssignmentItem

SubnetConfiguration

TrackedResourceTags

UserAssignedIdentities

UserAssignedIdentity

VirtualEnclaveApprovalSettings

VirtualEnclaveProperties

ARM template resource definition

Usage Examples

Resource format

Property Values

Microsoft.Mission/virtualEnclaves

ApprovalSettingConfiguration

EnclaveDefaultSettingsModel

EnclaveVirtualNetworkModel

GovernedServiceItem

MaintenanceModeConfigurationModel

ManagedServiceIdentity

MandatoryApprover

MonitoringDestination

MonitoringSettingsModel

Principal

RoleAssignmentItem

SubnetConfiguration

TrackedResourceTags

UserAssignedIdentities

UserAssignedIdentity

VirtualEnclaveApprovalSettings

VirtualEnclaveProperties

Terraform (AzAPI provider) resource definition

Resource format

Property Values

Microsoft.Mission/virtualEnclaves

ApprovalSettingConfiguration

EnclaveDefaultSettingsModel

EnclaveVirtualNetworkModel

GovernedServiceItem

MaintenanceModeConfigurationModel

ManagedServiceIdentity

MandatoryApprover

MonitoringDestination

MonitoringSettingsModel

Principal

RoleAssignmentItem

SubnetConfiguration

TrackedResourceTags

UserAssignedIdentities

UserAssignedIdentity

VirtualEnclaveApprovalSettings

VirtualEnclaveProperties

Feedback

Additional resources