Reference:
https://learn.microsoft.com/en-us/azure/virtual-machine-scale-sets/tutorial-use-custom-image-cli
https://learn.microsoft.com/en-us/dotnet/core/tools/

Explanation:
Box 1: "Microsoft.Resources/deployments"
Reference a secret with dynamic ID. You need to reference a key vault secret that varies based on the current deployment.
Example:
"resources": [
{
"apiVersion": "2018-05-01",
"name": "dynamicSecret",
"type": "Microsoft.Resources/deployments",
"properties": {
"mode": "Incremental",
"templateLink": {
Box 2: "templateLink"
In your parent template, you add the linked template and pass in a parameter that contains the dynamically generated resource ID.
Reference:
https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-keyvault- parameter

To authenticate a self-hosted GitHub Actions runner with Azure, you'll typically use either a managed identity or a service principal with OpenID Connect (OIDC). Managed identities are generally preferred for simplicity and security, especially with Azure Virtual Machines.
Alternatively, you can use a service principal and configure it with a federated identity credential, which can be helpful in more complex scenarios.
System-assigned managed identities are tied to a specific Azure resource and are deleted when the resource is deleted, while user-assigned managed identities are separate Azure resources that can be assigned to multiple resources.
In this scenario we need only a single user-assigned managed identity.
Reference:
https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/how-manage- user-assigned-managed-identities
https://learn.microsoft.com/en-us/azure/developer/github/connect-from-azure-identity

To implement a development solution for Azure Web Apps with multiple resources that provides individual developer environments, supports sandboxes, and integrates into CI/CD pipelines with minimal effort, you should use Azure Deployment Environments.
This service is specifically designed to provide self-service infrastructure for developers through standardized templates.
Meeting the Requirements
Individual Environments: Developers can self-serve environments on-demand via the Azure Developer Portal or CLI, ensuring they have their own isolated space for multiple resources.
Custom Sandbox Environments: Use "Sandbox" environment types to provide developers with flexible, experimental environments that automatically expire to minimize costs.
CI/CD Integration: Environments can be automatically spun up or deleted as part of a pipeline (e.g., creating a new environment for every Pull Request) using the Azure Developer CLI (azd) or Azure Pipelines.
Minimized Effort: Centralized template management via the Dev Center reduces the administrative overhead of managing separate resource groups or subscriptions manually for every developer.
Reference:
https://learn.microsoft.com/en-us/azure/deployment-environments/concept-environments-key- concepts