Bicep snippet for configuring Private Link from Azure Front Door

privateLinkFrontDoor.bicep

resource frontDoorOrigin 'Microsoft.Cdn/profiles/originGroups/origins@2025-09-01-preview' = {
  name: frontDoorOriginName
  parent: frontDoorOriginGroup
  properties: {
    hostName: frontDoorOriginHostName
    httpPort: 80
    httpsPort: 443
    originHostHeader: frontDoorOriginHostName
    priority: 1
    weight: 1000
    sharedPrivateLinkResource: {
      privateLink: {
        id: existingContainerEnvironment.id // You Container App Environment resource ID
      }
      privateLinkLocation: existingContainerEnvironment.location // The location must be the same as your Container App Environment
      groupId: 'managedEnvironments' // This actually refers to the resource type, not the resource group
      status: 'Approved' // This private link connection still requires manual approval from the target resource, as it is not in the same tenant/subscription and cannot be auto-approved
      requestMessage: 'Please approve this request to allow Front Door to access the container app'
    }
    enforceCertificateNameCheck: true
  }
}