Automate verification of Email Communication Services Domain

[tobiashein]

Hello,

I want to automate the provisioning of a new Email Communication Service resource with a custom domain binding via bicep. While the creation of the resource works fine, I'm not exactly sure how to automate the domain verification process.

Given a module like this, is there a way to access the values for the TXT and CNAME records I need to add to my DNS server, so I can return them as output values?

targetScope = 'resourceGroup'

param dataLocation string = 'Europe'
param domainName string
param emailServiceName string

resource emailService 'Microsoft.Communication/emailServices@2023-06-01-preview' = {
  name: emailServiceName
  location: 'global'
  properties: {
    dataLocation: dataLocation
  }

  resource emailServiceDomain 'domains' = {
    name: domainName
    location: 'global'
    properties: {
      domainManagement: 'CustomerManaged'
      userEngagementTracking: 'Disabled'
    }
  }
}

[sammydeprez]

You can make use of the properties of your emailServiceDomain.

So you can output the dns settings or use them to add the details to your Zone

output verificationRecords object = emailServiceDomain.properties.verificationRecords

[Bopila]

but this is not automating, it requires then manual configuration. I encountered the same issue what is the way to automatically configure via bicep not by script, so that to keep all as IaC?

[sammydeprez]

You can add those details via bicep in your dns zone as well

[Bopila]

Hi Sammy, Thanks for your response. What I was asking about was rather the method of verifying. As it needs to be done manually via accessing Azure Portal or using the PowerShell commands or Az-CLI. My question was if I am able to create such an IaC which is able to deploy ready to use resources. In my example I need to create an Azure Email Service, Azure Email Service Domain and Azure Communication Service and then I need to link the 'CustomerManaged' domain from Azure Email Service Domain to the ACS. But after the domain is delivered it needs to be verified. So indeed I can set up a DNS Zone with output records but in the final stage the verification cannot be done via Bicep. Additionally I'm struggling with another issue with the above. Namely I need to use AVM modules for Bicep and I need to create my custom modules referenced to the AVM one which is able to implement a couple of domains and senderUsernames for these domains(arrays) but Bicep does not support nested loops. This is my current code but it does not work I as would like: metadata name = 'Email Service' metadata description = 'This module deploys an Email Service in Azure Communication Services.' metadata version = '0.1.0' metadata owner = 'Cloud Platform Team' @description('Required. ShortName of the Service. (3 to 7 characters).') @minlength(3) @maxlength(7) param serviceShortName string @description('Required. Environment of the Service. (options: \'canary\', \'dev\', \'test\', \'acct\', \'live\').') @Allowed([ 'canary' 'dev' 'test' 'acct' 'live' ]) param environment string @description('Optional. Region resources are deployed in (ShortName of Location). (options: \'uks\', \'ukw\').') @Allowed([ 'uks' 'ukw' ]) param region string = 'uks' @description('Optional. The domains to deploy into this namespace.') param domains array? @description('Optional. Name of the domain to create.') param domainName string @description('Optional. Describes how the Domain resource is being managed.') @Allowed([ 'AzureManaged' 'CustomerManaged' 'CustomerManagedInExchangeOnline' ]) param domainManagement string @description('Optional. Describes whether user engagement tracking is enabled or disabled.') @Allowed([ 'Enabled' 'Disabled' ]) param userEngagementTracking string @description('Optional. Name of the sender username resource to create.') param nameOfSenderUsername string @description('Optional. A sender username to be used when sending emails.') param username string @description('Optional. The display name for the senderUsername.') param displayName string @description('Optional. The sender usernames to deploy into this namespace.') param senderUsernames array? @description('Optional. Tags to apply to the resources.') param tags object = { environment: environment service: serviceShortName } @description('Optional. Index of the resource.') param index string = '001' var emailServiceName = '${toLower('${serviceShortName}-${environment}')}-${region}-emailsvc-${index}' module emailService 'br/public:avm/res/communication/email-service:0.3.2' = { name: '${emailServiceName}-deployment' params: { name: emailServiceName dataLocation: 'UK' tags: tags domains: domains ?? [ { domainManagement: domainManagement name: domainName userEngagementTracking: userEngagementTracking senderUsernames: senderUsernames ?? [ { name: nameOfSenderUsername username: username displayName: displayName } ] } ] } } @description('The name of the Email Service.') output name string = emailService.outputs.name @description('The resource id of the Email Service.') output resourceId string = emailService.outputs.resourceId @description('The list of the email domain resource ids.') output domainResourceIds array = emailService.outputs.domainResourceIds @description('The list of the email domain names.') output domainNamess array = emailService.outputs.domainNamess It works but as you can see it does not iterate for all the domains and senderUsernames. I thought about the following solution but it does not work as well as it contains nested loops: module emailService 'br/public:avm/res/communication/email-service:0.3.2' = { name: '${emailServiceName}-deployment' params: { name: emailServiceName dataLocation: 'UK' tags: tags domains: [for domain in domains: { name: domain.name domainManagement: domain.domainManagement userEngagementTracking: domain.userEngagementTracking senderUsernames: [for sender in domain.senderUsernames: { name: sender.name username: sender.username displayName: sender.displayName }] }] } } or var formattedDomains = [ for domain in domains: { name: domain.name domainManagement: domain.domainManagement userEngagementTracking: domain.userEngagementTracking senderUsernames: [ for sender in (domain.senderUsernames ?? []): { name: sender.name username: sender.username displayName: sender.displayName } ] } ] module emailService 'br/public:avm/res/communication/email-service:0.3.2' = { name: '${emailServiceName}-deployment' params: { name: emailServiceName dataLocation: 'UK' tags: tags domains: formattedDomains } } Are you able to help? Kind regards, Bartosz czw., 6 mar 2025 o 10:09 Sammy Deprez ***@***.***> napisał(a):

…

You can add those details via bicep in your dns zone as well — Reply to this email directly, view it on GitHub <#12985 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AD66COQPNNYQ7DXSA5PIJVT2TAGDXAVCNFSM6AAAAABYNXIQFOVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTENBRGE2TONI> . You are receiving this because you commented.Message ID: ***@***.***>