Windchill AI Assistant Plugin > Installing and Configuring Windchill AI Assistant Plugin on On-prem Environment > Creating Azure Resources for On-prem Environment > ARM Template Reference Information
ARM Template Reference Information
The Windchill AI Assistant plugin uses an Azure Resource Manager (ARM) template (wcaia.json) and an associated parameter file (wcaia.parameters.json) to deploy the Azure resources. The parameter file defines deployment-specific values such as the Azure region, network configuration, encryption settings, AI model capacity, and storage options.
This topic describes every parameter in wcaia.parameters.json file, including its purpose, accepted values, default behavior, and related configuration considerations. Use it when you prepare the parameter file as part of Creating Azure Resources for On-prem Environment.
Parameter
Description
index_associations
A JSON object that maps each index name (the key) to the object ID of the service principal that may access that index (the value). One service principal can be associated with multiple indexes.
Specify at least one index. The maximum number of indexes depends on the AI Search SKU (50 by default).
* 
A service principal's object ID (also called the principal ID) is not the same as its client ID. To obtain the object ID from the client ID, run the following command:
az ad sp show --id <client-id> --query id -o tsv
location
The Azure region in which the resources are deployed. Not all regions support the required services and features.
The following are the accepted values:
• australiaeast
• brazilsouth
• canadaeast
• eastus
• eastus2
• francecentral
• germanywestcentral
• italynorth
• japaneast
• koreacentral
• northcentralus
• polandcentral
• southafricanorth
• southcentralus
• spaincentral
• swedencentral
• switzerlandnorth
• uaenorth
• uksouth
• westus
• westus3
* 
Review Microsoft's Azure AI Search supported regions documentation for region-specific limitations, including:
• Capacity constraints that can cause deployment failures.
• Reduced storage limits (for example, 25 GB instead of 160 GB), which can prevent some data from being indexed.
• Lack of availability zones, which can reduce availability guarantees.
common_tags
A JSON object of Azure tags, where each key is a tag name and each value is the corresponding tag value. The tags are applied to every resource that supports tagging. The object may be empty.
* 
If your organization enforces a tagging policy, omitting a required tag can cause a RequestDisallowedByPolicy error during resource creation.
allowed_ips
An allow-list of IP addresses or ranges in CIDR notation. When the list contains entries, only those addresses can reach the document storage account, the AI Search service, and the AI Foundry service. An empty list disables IP filtering.
This parameter must be empty when you deploy to a virtual network.
* 
When you do not deploy to a virtual network, the Azure resources are exposed on public internet address ranges. For hosts on internal networks (behind NAT), specify the public egress (NAT gateway) IP address or CIDR range.
vnet_config
Controls whether the resources are deployed into a virtual network. Resources deployed into a virtual network have public network access disabled and are reachable only through private endpoints in a chosen subnet. The deployment creates the required private DNS zones and links them to the virtual network.
To deploy without a virtual network, set this parameter to an empty JSON object.
To deploy into an existing virtual network, provide these keys:
• name—Name of the virtual network.
• resource_group_name—Resource group that contains the virtual network. Omit this key when the virtual network is in the same resource group as the deployed resources.
• subnet_name—Subnet used for the private endpoints. This subnet must not be delegated to any service.
* 
• The virtual network must be in the same region as the value of location.
• Automatic migration of resources out of a virtual network is not supported.
• The template does not configure routing inside or outside the virtual network. The Windchill AI Assistant plugin must be able to:
a. Resolve service endpoint domain names using the private DNS linked to the virtual network.
b. Communicate with the private endpoints inside the private endpoint subnet.
* 
To minimize downtime, complete the plugin host setup before you deploy the ARM template. Brief service interruptions can occur during migration.
ai_search_partition_count
The number of partitions in the AI Search service. For guidance on selecting a value, see Estimating the Required Number of Partitions for AI Search Service.
The minimum value is 1. The maximum value depends on the AI Search SKU and the value of ai_search_replica_count.
ai_search_replica_count
The number of replicas in the AI Search service.
Use 2 for production systems and 1 for non-production systems.
The minimum value is 1. The maximum value depends on the AI Search SKU and the value of ai_search_partition_count.
ai_search_cmk_encryption
Service-level configuration for AI Search encryption with customer-managed keys (CMK). For accepted values, see Parameters for Customer Managed Key Encryption.
ai_search_enforce_cmk_encryption
Specifies whether to allow access only to AI Search objects that are encrypted with customer-managed keys. This parameter applies only when CMK encryption is enabled. For details, see Azure documentation.
openai_deployment_capacity
Capacity units reserved for the gpt-5.4-mini model.
The maximum value depends on the Azure limits for the subscription's region and on the capacity already reserved by other AI Foundry model instances in that region. If the configured value exceeds the available limit, the deployment helper script reports the actual capacity that is available.
openai_deployment_sku
The deployment type for the gpt-5.4-mini model.
The following are the accepted values:
• DataZoneStandard
• GlobalStandard
• Standard
• DataZoneProvisionedManaged
• GlobalProvisionedManaged
• ProvisionedManaged
* 
Not all deployment types are available in every region, and each type has its own regional limit. If the selected deployment type is unavailable, the deployment helper script reports an error.
text_embedding_capacity
Capacity units reserved for the text-embedding-3-small model.
The maximum value depends on the Azure limits for the subscription's region and on the capacity already reserved by other AI Foundry model instances in that region. If the configured value exceeds the available limit, the deployment helper script reports the actual capacity that is available.
* 
Indexing speed depends on the available text-embedding capacity.
text_embedding_sku
The deployment type for the text-embedding-3-small model.
The following are the accepted values:
• DataZoneStandard
• GlobalStandard
• Standard
• DataZoneProvisionedManaged
• GlobalProvisionedManaged
• ProvisionedManaged
* 
Not all deployment types are available in every region, and each type has its own regional limit. If the selected deployment type is unavailable, the deployment helper script reports an error.
storage_sku
The Azure Storage SKU type for the document storage account. The default, Standard_LRS, is available in every region. In regions with multiple availability zones, Standard_ZRS can improve availability.
Only the following StorageV2 SKUs are supported:
• Standard_LRS
• Standard_ZRS
• Standard_GRS
• Standard_GZRS
• Standard_RAGRS
• Standard_RAGZRS
• Premium_LRS
• Premium_ZRS
* 
In some regions, Azure Storage supports only a subset of SKU types.
storage_access_tier
The access tier for document storage.
Only the following online tiers values are supported:
• Hot
• Cool
• Cold
storage_require_infrastructure_encryption
Specifies whether infrastructure encryption is enabled on the document storage account.
The following are the accepted values:
• true—Infrastructure encryption is enabled.
• false—Infrastructure encryption is disabled.
• null—Infrastructure encryption is unspecified (disabled).
If the storage account already exists, this value must match the setting already applied to that account.
* 
You cannot change the infrastructure encryption setting after the storage account is created.
storage_cmk_encryption
Customer-managed key (CMK) encryption configuration for the document storage account. For details, see Configuring Storage Account for Customer Managed Key Encryption.
diagnostic_settings_destinations
Where diagnostic data is written. Configure at least one of the following destinations. For a complete example of each, see Diagnostic destination examples.
• Blob storage:
◦ storage_account_id—Resource ID of the destination log storage account.
• Event hub:
◦ event_hub_authorization_rule_id—Resource ID of the event hub authorization rule.
◦ event_hub_name—Name of the event hub to use.
• Log Analytics workspace:
◦ workspace_id—Resource ID of the Log Analytics workspace.
◦ log_analytics_destination_type—Set to Dedicated, to write each event type to its own table. Set to null or omit it to write all events to a single table.
• Managed blob storage:
◦ managed_log_storage_sku—Azure Storage SKU type for the log storage account. The default, Standard_LRS, is available in every region. Standard_ZRS can improve availability where multiple availability zones exist.
◦ managed_log_storage_access_tier—Access tier for the log storage.
◦ managed_log_storage_allowed_ips—Allow-list of IP addresses or CIDR ranges. When not empty, the log storage account is reachable only from the listed addresses; an empty list disables IP filtering.
◦ managed_log_storage_cmk_encryption—CMK encryption configuration for the log storage account.
◦ managed_log_storage_require_infrastructure_encryption—Specifies infrastructure encryption is enabled on the log storage account.
• Marketplace product:
◦ marketplace_partner_id—Partner ID of an Azure Marketplace product.
* 
• The managed log storage destination and blob storage destination are mutually exclusive.
• Some destination types have restrictions on location and network configuration. For details, see the Azure documentation.
Customer-managed Key Encryption
Customer-managed key (CMK) encryption lets you supply your own key, stored in an Azure Key Vault or a hardware security module (HSM), instead of relying on an Azure-managed key. CMK settings apply to the ai_search_cmk_encryption, storage_cmk_encryption, and managed_log_storage_cmk_encryption parameters.
Parameters for Customer Managed Key Encryption
An empty JSON object indicates that an Azure-managed key is used. To enable CMK encryption, populate the object with the following entries:
• user_assigned_identity—Resource ID of a managed identity that has permission to access the encryption key.
• federated_identity_client_id—Client ID of the identity that enables cross-tenant access. Required only when the Key Vault or HSM that holds the key is in another tenant.
• key_vault_uri—HTTPS URL of the Key Vault or HSM that stores the key. Use the service URL, not the key URL.
• key_name—Name of the key within the Key Vault or HSM.
• key_version—Specific key version to use, or null to always use the latest version.
Example:
{
"user_assigned_identity": "/subscriptions/763bdf6c-59c4-11f1-9e52-5b9682da6fa8/resourceGroups/acme-wcaia-dev/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acme-wcaia-dev-enc-keys-access",
"key_vault_uri": "https://wcaia-acme-dev-enc-keys.vault.azure.net",
"key_name": "cmk-key",
"key_version": null
}
Configuring Storage Account for Customer Managed Key Encryption
Use the values described in Parameters for Customer Managed Key Encryption.
* 
The current template version cannot disable CMK encryption once it has been enabled.
For more information, see Customer-managed keys for Azure Storage encryption, and Update the key version.
Diagnostic Destination Examples
Each example shows the JSON to supply for the diagnostic_settings_destinations parameter's value.
Blob storage:
{
"storage_account_id": "/subscriptions/763bdf6c-59c4-11f1-9e52-5b9682da6fa8/resourceGroups/acme-wcaia-dev/providers/Microsoft.Storage/storageAccounts/acmewcaiadevlogs"
}
Event hub:
{
"event_hub_authorization_rule_id": "/subscriptions/763bdf6c-59c4-11f1-9e52-5b9682da6fa8/resourceGroups/acme-wcaia-dev/providers/Microsoft.EventHub/namespaces/loghub/authorizationrules/send",
"event_hub_name": "hub1"
}
Log Analytics workspace
{
"workspace_id": "/subscriptions/763bdf6c-59c4-11f1-9e52-5b9682da6fa8/resourcegroups/acme-wcaia-dev/providers/Microsoft.OperationalInsights/workspaces/central-log-analytics",
"log_analytics_destination_type": "Dedicated"
}
Managed blob storage:
{
"managed_log_storage_sku": "Standard_ZRS",
"managed_log_storage_access_tier": "Hot",
"managed_log_storage_allowed_ips": [],
"managed_log_storage_cmk_encryption": {
"user_assigned_identity": "/subscriptions/763bdf6c-59c4-11f1-9e52-5b9682da6fa8/resourceGroups/acme-wcaia-dev/providers/Microsoft.ManagedIdentity/userAssignedIdentities/acme-wcaia-dev-enc-keys-access",
"key_vault_uri": "https://wcaia-acme-dev-enc-keys.vault.azure.net",
"key_name": "log-storage",
"key_version": null
},
"managed_log_storage_require_infrastructure_encryption": true
}
Migrating from the 2026.0.0.20 Parameters File to the 2026.1.0.xx Format
The following changes were introduced after Windchill AI Assistant 2026.0.0.20:
• The management_token, management_token_expires_on, search_token, and search_token_expires_on parameters were removed without replacement.
• The index_names and service_principal_id parameters were restructured into index_associations. This change provides increased isolation when multiple environments share the same Azure infrastructure.
• The vnet_config parameter was added to support deployment into a virtual network.
• The ai_search_replica_count parameter was exposed.
• The ai_search_cmk_encryption and ai_search_enforce_cmk_encryption parameters were added to support customer-managed key encryption.
• The openai_deployment_capacity and openai_deployment_sku parameters were exposed to allow you to choose the GPT model’s capacity and deployment type.
• The text_embedding_sku parameter was exposed to allow you to choose the embedding model’s deployment type.
• The storage_access_tier parameter was exposed to allow you to configure the document storage account parameters.
• The storage_cmk_encryption parameter was added to support customer-managed key encryption.
• The storage_require_infrastructure_encryption parameter was exposed to allow you to create the document storage account with infrastructure encryption enabled.
• The diagnostic_settings_destinations parameter was added to support additional diagnostic destination types.
* 
Windchill AI Assistant version 2026.1.0.xx switches from gpt-5-mini to gpt-5.4-mini. The gpt-5-mini model is left in place to allow gradual migration when multiple plugin instances share the same Azure resource deployment. After you migrate all plugins to 2026.1.0.xx, remove the gpt-5-mini model from AI Foundry.
Follow these steps to migrate:
1. Start from the parameter template shipped with the Windchill AI Assistant 2026.1.0.xx release.
2. Copy the values of location, common_tags, allowed_ips, ai_search_partition_count, and text_embedding_capacity from the 2026.0.0.20 template file.
3. Use the names from the 2026.0.0.20 index_names parameter as keys in the new index_associations object. Use the 2026.0.0.20 service_principal_id value as each key's value.
4. When migrating from an IP-filtered setup to a virtual network setup, empty the allowed_ips array and populate vnet_config with the virtual network information.
5. Specify one or more destinations in the diagnostic_settings_destinations parameter. To continue using the 2026.0.0.20 log storage account, use the managed blob storage destination.
6. Adjust the default values of the remaining parameters as needed.
Example 2026.0.0.20 parameters file (before migration):
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"management_token": { "value": "SET_BY_PYTHON_SCRIPT" },
"management_token_expires_on": { "value": "SET_BY_PYTHON_SCRIPT" },
"search_token": { "value": "SET_BY_PYTHON_SCRIPT" },
"search_token_expires_on": { "value": "SET_BY_PYTHON_SCRIPT" },
"index_names": { "value": ["index1", "index2"] },
"location": { "value": "swedencentral" },
"common_tags": {
"value": { "Project": "Windchill AI Chat Plugin", "Environment": "QA" }
},
"service_principal_id": { "value": "cb0eca9c-58fa-11f1-bf77-83f2007ce701" },
"allowed_ips": { "value": ["192.0.2.0/24"] },
"ai_search_partition_count": { "value": 1 },
"text_embedding_capacity": { "value": 4000 }
}
}
Example 2026.1.0.xx parameter file (after migration, including a move to a virtual network):
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"index_associations": {
"value": {
"index1": "cb0eca9c-58fa-11f1-bf77-83f2007ce701",
"index2": "cb0eca9c-58fa-11f1-bf77-83f2007ce701"
}
},
"location": { "value": "swedencentral" },
"common_tags": {
"value": { "Project": "Windchill AI Chat Plugin", "Environment": "QA" }
},
"allowed_ips": { "value": [] },
"vnet_config": {
"value": { "name": "acme-wc-swedencentral", "subnet_name": "private-endpoints" }
},
"ai_search_partition_count": { "value": 1 },
"ai_search_replica_count": { "value": 2 },
"ai_search_cmk_encryption": { "value": {} },
"ai_search_enforce_cmk_encryption": { "value": false },
"openai_deployment_capacity": { "value": 1000 },
"openai_deployment_sku": { "value": "GlobalStandard" },
"text_embedding_capacity": { "value": 4000 },
"text_embedding_sku": { "value": "GlobalStandard" },
"storage_sku": { "value": "Standard_LRS" },
"storage_access_tier": { "value": "Hot" },
"storage_require_infrastructure_encryption": { "value": false },
"storage_cmk_encryption": { "value": {} },
"diagnostic_settings_destinations": {
"value": {
"managed_log_storage_sku": "Standard_LRS",
"managed_log_storage_access_tier": "Hot",
"managed_log_storage_allowed_ips": [],
"managed_log_storage_cmk_encryption": {},
"managed_log_storage_require_infrastructure_encryption": false
}
}
}
}
Retrieving the Parameter File from a Previous Deployment
The parameters are stored in the outputs of the Azure deployment. To retrieve them, run:
az deployment group show
--resource-group ${RESOURCE_GROUP}
--name ${DEPLOYMENT_NAME}
--output json
--query 'properties.outputs.parameters_json.value'
Removing an Obsolete Index
To remove an obsolete (unused) index, complete the following three steps:
1. Update the parameters file. Remove the index from the index_associations parameter and deploy the modification. This removes the reference to the index from the Azure deployment but keeps all resources intact.
2. Run the cleanup command. This removes the document storage container and permissions to access the index. AI Search index resources are retained.
python3 remove-wcaia-index.py
--resource-group ${RESOURCE_GROUP}
--deployment-name ${DEPLOYMENT_NAME}
--index-name ${INDEX_NAME}
3. Remove the AI Search index resources. The signed-in identity must have the Search Index Data Contributor role assigned at the scope of the index or the AI Service (the corresponding service principal can be used). The ${ENDPOINT} is the AI Search service endpoint as specified in the plugin configuration.
az rest --method DELETE --url "${ENDPOINT}/indexers/${INDEX_NAME}-indexer?api-version=2025-09-01" --resource https://search.azure.com
az rest --method DELETE --url "${ENDPOINT}/datasources/${INDEX_NAME}-blob?api-version=2025-09-01" --resource https://search.azure.com
az rest --method DELETE --url "${ENDPOINT}/skillsets/${INDEX_NAME}-skillset?api-version=2025-09-01" --resource https://search.azure.com
az rest --method DELETE --url "${ENDPOINT}/indexes/${INDEX_NAME}?api-version=2025-09-01" --resource https://search.azure.com
Known Limitations
• Storage account encryption with a customer-managed key cannot be migrated back to an Azure-managed key.
Workaround: Change the configuration either in the Azure portal or from the command line.
• Migration from a virtual network setup to a non-virtual-network setup is not supported.
• Attempts to migrate from a virtual network setup to a non-virtual-network setup are not diagnosed.
Isto foi útil?