From ec84fe3e0537f81bcff8a565f308c1477777ad04 Mon Sep 17 00:00:00 2001
From: Elisa Anzelmo <elisa.anzelmo@microsoft.com>
Date: Tue, 5 Dec 2023 15:03:59 +0100
Subject: [PATCH] categorygroup

---
 .../automation/automation-account/README.md   | 492 +++++++++++-------
 .../automation-account/job-schedule/README.md |  36 +-
 .../automation-account/module/README.md       |  30 +-
 .../automation-account/runbook/README.md      |  67 ++-
 .../automation-account/schedule/README.md     |  40 +-
 .../software-update-configuration/README.md   | 147 ++++--
 .../tests/e2e/waf-aligned/main.test.bicep     |  13 +-
 .../automation-account/variable/README.md     |  29 +-
 8 files changed, 502 insertions(+), 352 deletions(-)

diff --git a/avm/res/automation/automation-account/README.md b/avm/res/automation/automation-account/README.md
index e8a9bca4ee..9f667a1775 100644
--- a/avm/res/automation/automation-account/README.md
+++ b/avm/res/automation/automation-account/README.md
@@ -646,6 +646,11 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
       {
         eventHubAuthorizationRuleResourceId: '<eventHubAuthorizationRuleResourceId>'
         eventHubName: '<eventHubName>'
+        logCategoriesAndGroups: [
+          {
+            categoryGroup: 'AllLogs'
+          }
+        ]
         storageAccountResourceId: '<storageAccountResourceId>'
         workspaceResourceId: '<workspaceResourceId>'
       }
@@ -845,6 +850,11 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
         {
           "eventHubAuthorizationRuleResourceId": "<eventHubAuthorizationRuleResourceId>",
           "eventHubName": "<eventHubName>",
+          "logCategoriesAndGroups": [
+            {
+              "categoryGroup": "AllLogs"
+            }
+          ],
           "storageAccountResourceId": "<storageAccountResourceId>",
           "workspaceResourceId": "<workspaceResourceId>"
         }
@@ -1088,44 +1098,58 @@ module automationAccount 'br/public:avm/res/automation/automation-account:<versi
 | [`tags`](#parameter-tags) | object | Tags of the Automation Account resource. |
 | [`variables`](#parameter-variables) | array | List of variables to be created in the automation account. |
 
+### Parameter: `name`
+
+Name of the Automation Account.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `customerManagedKey`
 
 The customer managed key definition.
+
 - Required: No
 - Type: object
 
+**Required parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`keyName`](#parameter-customermanagedkeykeyname) | Yes | string | Required. The name of the customer managed key to use for encryption. |
-| [`keyVaultResourceId`](#parameter-customermanagedkeykeyvaultresourceid) | Yes | string | Required. The resource ID of a key vault to reference a customer managed key for encryption from. |
-| [`keyVersion`](#parameter-customermanagedkeykeyversion) | No | string | Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'. |
-| [`userAssignedIdentityResourceId`](#parameter-customermanagedkeyuserassignedidentityresourceid) | No | string | Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`keyName`](#parameter-customermanagedkeykeyname) | string | The name of the customer managed key to use for encryption. |
+| [`keyVaultResourceId`](#parameter-customermanagedkeykeyvaultresourceid) | string | The resource ID of a key vault to reference a customer managed key for encryption from. |
+
+**Optional parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`keyVersion`](#parameter-customermanagedkeykeyversion) | string | The version of the customer managed key to reference for encryption. If not provided, using 'latest'. |
+| [`userAssignedIdentityResourceId`](#parameter-customermanagedkeyuserassignedidentityresourceid) | string | User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use. |
 
 ### Parameter: `customerManagedKey.keyName`
 
-Required. The name of the customer managed key to use for encryption.
+The name of the customer managed key to use for encryption.
 
 - Required: Yes
 - Type: string
 
 ### Parameter: `customerManagedKey.keyVaultResourceId`
 
-Required. The resource ID of a key vault to reference a customer managed key for encryption from.
+The resource ID of a key vault to reference a customer managed key for encryption from.
 
 - Required: Yes
 - Type: string
 
 ### Parameter: `customerManagedKey.keyVersion`
 
-Optional. The version of the customer managed key to reference for encryption. If not provided, using 'latest'.
+The version of the customer managed key to reference for encryption. If not provided, using 'latest'.
 
 - Required: No
 - Type: string
 
 ### Parameter: `customerManagedKey.userAssignedIdentityResourceId`
 
-Optional. User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use.
+User assigned identity to use when fetching the customer managed key. Required if no system assigned identity is available for use.
 
 - Required: No
 - Type: string
@@ -1133,114 +1157,90 @@ Optional. User assigned identity to use when fetching the customer managed key.
 ### Parameter: `diagnosticSettings`
 
 The diagnostic settings of the service.
+
 - Required: No
 - Type: array
 
+**Optional parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`eventHubAuthorizationRuleResourceId`](#parameter-diagnosticsettingseventhubauthorizationruleresourceid) | No | string | Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to. |
-| [`eventHubName`](#parameter-diagnosticsettingseventhubname) | No | string | Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
-| [`logAnalyticsDestinationType`](#parameter-diagnosticsettingsloganalyticsdestinationtype) | No | string | Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type. |
-| [`logCategoriesAndGroups`](#parameter-diagnosticsettingslogcategoriesandgroups) | No | array | Optional. The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection. |
-| [`marketplacePartnerResourceId`](#parameter-diagnosticsettingsmarketplacepartnerresourceid) | No | string | Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs. |
-| [`metricCategories`](#parameter-diagnosticsettingsmetriccategories) | No | array | Optional. The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection. |
-| [`name`](#parameter-diagnosticsettingsname) | No | string | Optional. The name of diagnostic setting. |
-| [`storageAccountResourceId`](#parameter-diagnosticsettingsstorageaccountresourceid) | No | string | Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
-| [`workspaceResourceId`](#parameter-diagnosticsettingsworkspaceresourceid) | No | string | Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`eventHubAuthorizationRuleResourceId`](#parameter-diagnosticsettingseventhubauthorizationruleresourceid) | string | Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to. |
+| [`eventHubName`](#parameter-diagnosticsettingseventhubname) | string | Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
+| [`logAnalyticsDestinationType`](#parameter-diagnosticsettingsloganalyticsdestinationtype) | string | A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type. |
+| [`logCategoriesAndGroups`](#parameter-diagnosticsettingslogcategoriesandgroups) | array | The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection. |
+| [`marketplacePartnerResourceId`](#parameter-diagnosticsettingsmarketplacepartnerresourceid) | string | The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs. |
+| [`metricCategories`](#parameter-diagnosticsettingsmetriccategories) | array | The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection. |
+| [`name`](#parameter-diagnosticsettingsname) | string | The name of diagnostic setting. |
+| [`storageAccountResourceId`](#parameter-diagnosticsettingsstorageaccountresourceid) | string | Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
+| [`workspaceResourceId`](#parameter-diagnosticsettingsworkspaceresourceid) | string | Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub. |
 
 ### Parameter: `diagnosticSettings.eventHubAuthorizationRuleResourceId`
 
-Optional. Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to.
+Resource ID of the diagnostic event hub authorization rule for the Event Hubs namespace in which the event hub should be created or streamed to.
 
 - Required: No
 - Type: string
 
 ### Parameter: `diagnosticSettings.eventHubName`
 
-Optional. Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
+Name of the diagnostic event hub within the namespace to which logs are streamed. Without this, an event hub is created for each log category. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
 
 - Required: No
 - Type: string
 
 ### Parameter: `diagnosticSettings.logAnalyticsDestinationType`
 
-Optional. A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type.
+A string indicating whether the export to Log Analytics should use the default destination type, i.e. AzureDiagnostics, or use a destination type.
 
 - Required: No
 - Type: string
-- Allowed: `[AzureDiagnostics, Dedicated]`
+- Allowed:
+  ```Bicep
+  [
+    'AzureDiagnostics'
+    'Dedicated'
+  ]
+  ```
 
 ### Parameter: `diagnosticSettings.logCategoriesAndGroups`
 
-Optional. The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection.
+The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection.
 
 - Required: No
 - Type: array
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`category`](#parameter-diagnosticsettingslogcategoriesandgroupscategory) | No | string | Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here. |
-| [`categoryGroup`](#parameter-diagnosticsettingslogcategoriesandgroupscategorygroup) | No | string | Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to 'AllLogs' to collect all logs. |
-
-### Parameter: `diagnosticSettings.logCategoriesAndGroups.category`
-
-Optional. Name of a Diagnostic Log category for a resource type this setting is applied to. Set the specific logs to collect here.
-
-- Required: No
-- Type: string
-
-### Parameter: `diagnosticSettings.logCategoriesAndGroups.categoryGroup`
-
-Optional. Name of a Diagnostic Log category group for a resource type this setting is applied to. Set to 'AllLogs' to collect all logs.
-
-- Required: No
-- Type: string
-
-
 ### Parameter: `diagnosticSettings.marketplacePartnerResourceId`
 
-Optional. The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.
+The full ARM resource ID of the Marketplace resource to which you would like to send Diagnostic Logs.
 
 - Required: No
 - Type: string
 
 ### Parameter: `diagnosticSettings.metricCategories`
 
-Optional. The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection.
+The name of logs that will be streamed. "allLogs" includes all possible logs for the resource. Set to '' to disable log collection.
 
 - Required: No
 - Type: array
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`category`](#parameter-diagnosticsettingsmetriccategoriescategory) | Yes | string | Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to 'AllMetrics' to collect all metrics. |
-
-### Parameter: `diagnosticSettings.metricCategories.category`
-
-Required. Name of a Diagnostic Metric category for a resource type this setting is applied to. Set to 'AllMetrics' to collect all metrics.
-
-- Required: Yes
-- Type: string
-
-
 ### Parameter: `diagnosticSettings.name`
 
-Optional. The name of diagnostic setting.
+The name of diagnostic setting.
 
 - Required: No
 - Type: string
 
 ### Parameter: `diagnosticSettings.storageAccountResourceId`
 
-Optional. Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
+Resource ID of the diagnostic storage account. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
 
 - Required: No
 - Type: string
 
 ### Parameter: `diagnosticSettings.workspaceResourceId`
 
-Optional. Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
+Resource ID of the diagnostic log analytics workspace. For security reasons, it is recommended to set diagnostic settings to send data to either storage account, log analytics workspace or event hub.
 
 - Required: No
 - Type: string
@@ -1248,6 +1248,7 @@ Optional. Resource ID of the diagnostic log analytics workspace. For security re
 ### Parameter: `disableLocalAuth`
 
 Disable local authentication profile used within the resource.
+
 - Required: No
 - Type: bool
 - Default: `True`
@@ -1255,6 +1256,7 @@ Disable local authentication profile used within the resource.
 ### Parameter: `enableTelemetry`
 
 Enable/Disable usage telemetry for module.
+
 - Required: No
 - Type: bool
 - Default: `True`
@@ -1262,6 +1264,7 @@ Enable/Disable usage telemetry for module.
 ### Parameter: `gallerySolutions`
 
 List of gallerySolutions to be created in the linked log analytics workspace.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -1269,6 +1272,7 @@ List of gallerySolutions to be created in the linked log analytics workspace.
 ### Parameter: `jobSchedules`
 
 List of jobSchedules to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -1276,6 +1280,7 @@ List of jobSchedules to be created in the automation account.
 ### Parameter: `linkedWorkspaceResourceId`
 
 ID of the log analytics workspace to be linked to the deployed automation account.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -1283,6 +1288,7 @@ ID of the log analytics workspace to be linked to the deployed automation accoun
 ### Parameter: `location`
 
 Location for all resources.
+
 - Required: No
 - Type: string
 - Default: `[resourceGroup().location]`
@@ -1290,26 +1296,35 @@ Location for all resources.
 ### Parameter: `lock`
 
 The lock settings of the service.
+
 - Required: No
 - Type: object
 
+**Optional parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`kind`](#parameter-lockkind) | No | string | Optional. Specify the type of lock. |
-| [`name`](#parameter-lockname) | No | string | Optional. Specify the name of lock. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`kind`](#parameter-lockkind) | string | Specify the type of lock. |
+| [`name`](#parameter-lockname) | string | Specify the name of lock. |
 
 ### Parameter: `lock.kind`
 
-Optional. Specify the type of lock.
+Specify the type of lock.
 
 - Required: No
 - Type: string
-- Allowed: `[CanNotDelete, None, ReadOnly]`
+- Allowed:
+  ```Bicep
+  [
+    'CanNotDelete'
+    'None'
+    'ReadOnly'
+  ]
+  ```
 
 ### Parameter: `lock.name`
 
-Optional. Specify the name of lock.
+Specify the name of lock.
 
 - Required: No
 - Type: string
@@ -1317,25 +1332,27 @@ Optional. Specify the name of lock.
 ### Parameter: `managedIdentities`
 
 The managed identity definition for this resource.
+
 - Required: No
 - Type: object
 
+**Optional parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`systemAssigned`](#parameter-managedidentitiessystemassigned) | No | bool | Optional. Enables system assigned managed identity on the resource. |
-| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | No | array | Optional. The resource ID(s) to assign to the resource. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`systemAssigned`](#parameter-managedidentitiessystemassigned) | bool | Enables system assigned managed identity on the resource. |
+| [`userAssignedResourceIds`](#parameter-managedidentitiesuserassignedresourceids) | array | The resource ID(s) to assign to the resource. |
 
 ### Parameter: `managedIdentities.systemAssigned`
 
-Optional. Enables system assigned managed identity on the resource.
+Enables system assigned managed identity on the resource.
 
 - Required: No
 - Type: bool
 
 ### Parameter: `managedIdentities.userAssignedResourceIds`
 
-Optional. The resource ID(s) to assign to the resource.
+The resource ID(s) to assign to the resource.
 
 - Required: No
 - Type: array
@@ -1343,210 +1360,255 @@ Optional. The resource ID(s) to assign to the resource.
 ### Parameter: `modules`
 
 List of modules to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
 
-### Parameter: `name`
-
-Name of the Automation Account.
-- Required: Yes
-- Type: string
-
 ### Parameter: `privateEndpoints`
 
 Configuration details for private endpoints. For security reasons, it is recommended to use private endpoints whenever possible.
+
 - Required: No
 - Type: array
 
+**Required parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`applicationSecurityGroupResourceIds`](#parameter-privateendpointsapplicationsecuritygroupresourceids) | No | array | Optional. Application security groups in which the private endpoint IP configuration is included. |
-| [`customDnsConfigs`](#parameter-privateendpointscustomdnsconfigs) | No | array | Optional. Custom DNS configurations. |
-| [`customNetworkInterfaceName`](#parameter-privateendpointscustomnetworkinterfacename) | No | string | Optional. The custom name of the network interface attached to the private endpoint. |
-| [`enableTelemetry`](#parameter-privateendpointsenabletelemetry) | No | bool | Optional. Enable/Disable usage telemetry for module. |
-| [`ipConfigurations`](#parameter-privateendpointsipconfigurations) | No | array | Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints. |
-| [`location`](#parameter-privateendpointslocation) | No | string | Optional. The location to deploy the private endpoint to. |
-| [`lock`](#parameter-privateendpointslock) | No | object | Optional. Specify the type of lock. |
-| [`manualPrivateLinkServiceConnections`](#parameter-privateendpointsmanualprivatelinkserviceconnections) | No | array | Optional. Manual PrivateLink Service Connections. |
-| [`name`](#parameter-privateendpointsname) | No | string | Optional. The name of the private endpoint. |
-| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | No | string | Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
-| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | No | array | Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
-| [`roleAssignments`](#parameter-privateendpointsroleassignments) | No | array | Optional. Array of role assignments to create. |
-| [`service`](#parameter-privateendpointsservice) | Yes | string | Required. The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob". |
-| [`subnetResourceId`](#parameter-privateendpointssubnetresourceid) | Yes | string | Required. Resource ID of the subnet where the endpoint needs to be created. |
-| [`tags`](#parameter-privateendpointstags) | No | object | Optional. Tags to be applied on all resources/resource groups in this deployment. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`service`](#parameter-privateendpointsservice) | string | The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob". |
+| [`subnetResourceId`](#parameter-privateendpointssubnetresourceid) | string | Resource ID of the subnet where the endpoint needs to be created. |
 
-### Parameter: `privateEndpoints.applicationSecurityGroupResourceIds`
+**Optional parameters**
 
-Optional. Application security groups in which the private endpoint IP configuration is included.
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`applicationSecurityGroupResourceIds`](#parameter-privateendpointsapplicationsecuritygroupresourceids) | array | Application security groups in which the private endpoint IP configuration is included. |
+| [`customDnsConfigs`](#parameter-privateendpointscustomdnsconfigs) | array | Custom DNS configurations. |
+| [`customNetworkInterfaceName`](#parameter-privateendpointscustomnetworkinterfacename) | string | The custom name of the network interface attached to the private endpoint. |
+| [`enableTelemetry`](#parameter-privateendpointsenabletelemetry) | bool | Enable/Disable usage telemetry for module. |
+| [`ipConfigurations`](#parameter-privateendpointsipconfigurations) | array | A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints. |
+| [`location`](#parameter-privateendpointslocation) | string | The location to deploy the private endpoint to. |
+| [`lock`](#parameter-privateendpointslock) | object | Specify the type of lock. |
+| [`manualPrivateLinkServiceConnections`](#parameter-privateendpointsmanualprivatelinkserviceconnections) | array | Manual PrivateLink Service Connections. |
+| [`name`](#parameter-privateendpointsname) | string | The name of the private endpoint. |
+| [`privateDnsZoneGroupName`](#parameter-privateendpointsprivatednszonegroupname) | string | The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided. |
+| [`privateDnsZoneResourceIds`](#parameter-privateendpointsprivatednszoneresourceids) | array | The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones. |
+| [`roleAssignments`](#parameter-privateendpointsroleassignments) | array | Array of role assignments to create. |
+| [`tags`](#parameter-privateendpointstags) | object | Tags to be applied on all resources/resource groups in this deployment. |
 
-- Required: No
-- Type: array
+### Parameter: `privateEndpoints.service`
 
-### Parameter: `privateEndpoints.customDnsConfigs`
+The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob".
 
-Optional. Custom DNS configurations.
+- Required: Yes
+- Type: string
 
-- Required: No
-- Type: array
+### Parameter: `privateEndpoints.subnetResourceId`
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`fqdn`](#parameter-privateendpointscustomdnsconfigsfqdn) | No | string | Required. Fqdn that resolves to private endpoint ip address. |
-| [`ipAddresses`](#parameter-privateendpointscustomdnsconfigsipaddresses) | Yes | array | Required. A list of private ip addresses of the private endpoint. |
+Resource ID of the subnet where the endpoint needs to be created.
 
-### Parameter: `privateEndpoints.customDnsConfigs.fqdn`
+- Required: Yes
+- Type: string
 
-Required. Fqdn that resolves to private endpoint ip address.
+### Parameter: `privateEndpoints.applicationSecurityGroupResourceIds`
+
+Application security groups in which the private endpoint IP configuration is included.
 
 - Required: No
-- Type: string
+- Type: array
 
-### Parameter: `privateEndpoints.customDnsConfigs.ipAddresses`
+### Parameter: `privateEndpoints.customDnsConfigs`
 
-Required. A list of private ip addresses of the private endpoint.
+Custom DNS configurations.
 
-- Required: Yes
+- Required: No
 - Type: array
 
-
 ### Parameter: `privateEndpoints.customNetworkInterfaceName`
 
-Optional. The custom name of the network interface attached to the private endpoint.
+The custom name of the network interface attached to the private endpoint.
 
 - Required: No
 - Type: string
 
 ### Parameter: `privateEndpoints.enableTelemetry`
 
-Optional. Enable/Disable usage telemetry for module.
+Enable/Disable usage telemetry for module.
 
 - Required: No
 - Type: bool
 
 ### Parameter: `privateEndpoints.ipConfigurations`
 
-Optional. A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints.
+A list of IP configurations of the private endpoint. This will be used to map to the First Party Service endpoints.
 
 - Required: No
 - Type: array
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`name`](#parameter-privateendpointsipconfigurationsname) | Yes | string | Required. The name of the resource that is unique within a resource group. |
-| [`properties`](#parameter-privateendpointsipconfigurationsproperties) | Yes | object | Required. Properties of private endpoint IP configurations. |
-
-### Parameter: `privateEndpoints.ipConfigurations.name`
+### Parameter: `privateEndpoints.location`
 
-Required. The name of the resource that is unique within a resource group.
+The location to deploy the private endpoint to.
 
-- Required: Yes
+- Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.ipConfigurations.properties`
+### Parameter: `privateEndpoints.lock`
 
-Required. Properties of private endpoint IP configurations.
+Specify the type of lock.
 
-- Required: Yes
+- Required: No
 - Type: object
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`groupId`](#parameter-privateendpointsipconfigurationspropertiesgroupid) | Yes | string | Required. The ID of a group obtained from the remote resource that this private endpoint should connect to. |
-| [`memberName`](#parameter-privateendpointsipconfigurationspropertiesmembername) | Yes | string | Required. The member name of a group obtained from the remote resource that this private endpoint should connect to. |
-| [`privateIPAddress`](#parameter-privateendpointsipconfigurationspropertiesprivateipaddress) | Yes | string | Required. A private ip address obtained from the private endpoint's subnet. |
+**Optional parameters**
 
-### Parameter: `privateEndpoints.ipConfigurations.properties.groupId`
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`kind`](#parameter-privateendpointslockkind) | string | Specify the type of lock. |
+| [`name`](#parameter-privateendpointslockname) | string | Specify the name of lock. |
 
-Required. The ID of a group obtained from the remote resource that this private endpoint should connect to.
+### Parameter: `privateEndpoints.lock.kind`
 
-- Required: Yes
+Specify the type of lock.
+
+- Required: No
 - Type: string
+- Allowed:
+  ```Bicep
+  [
+    'CanNotDelete'
+    'None'
+    'ReadOnly'
+  ]
+  ```
 
-### Parameter: `privateEndpoints.ipConfigurations.properties.memberName`
+### Parameter: `privateEndpoints.lock.name`
 
-Required. The member name of a group obtained from the remote resource that this private endpoint should connect to.
+Specify the name of lock.
 
-- Required: Yes
+- Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.ipConfigurations.properties.privateIPAddress`
+### Parameter: `privateEndpoints.manualPrivateLinkServiceConnections`
 
-Required. A private ip address obtained from the private endpoint's subnet.
+Manual PrivateLink Service Connections.
 
-- Required: Yes
-- Type: string
+- Required: No
+- Type: array
 
+### Parameter: `privateEndpoints.name`
 
+The name of the private endpoint.
 
-### Parameter: `privateEndpoints.location`
+- Required: No
+- Type: string
+
+### Parameter: `privateEndpoints.privateDnsZoneGroupName`
 
-Optional. The location to deploy the private endpoint to.
+The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.lock`
+### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
 
-Optional. Specify the type of lock.
+The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
 
 - Required: No
-- Type: object
+- Type: array
 
-### Parameter: `privateEndpoints.manualPrivateLinkServiceConnections`
+### Parameter: `privateEndpoints.roleAssignments`
 
-Optional. Manual PrivateLink Service Connections.
+Array of role assignments to create.
 
 - Required: No
 - Type: array
 
-### Parameter: `privateEndpoints.name`
+**Required parameters**
+
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`principalId`](#parameter-privateendpointsroleassignmentsprincipalid) | string | The principal ID of the principal (user/group/identity) to assign the role to. |
+| [`roleDefinitionIdOrName`](#parameter-privateendpointsroleassignmentsroledefinitionidorname) | string | The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
 
-Optional. The name of the private endpoint.
+**Optional parameters**
 
-- Required: No
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`condition`](#parameter-privateendpointsroleassignmentscondition) | string | The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container" |
+| [`conditionVersion`](#parameter-privateendpointsroleassignmentsconditionversion) | string | Version of the condition. |
+| [`delegatedManagedIdentityResourceId`](#parameter-privateendpointsroleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
+| [`description`](#parameter-privateendpointsroleassignmentsdescription) | string | The description of the role assignment. |
+| [`principalType`](#parameter-privateendpointsroleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
+
+### Parameter: `privateEndpoints.roleAssignments.principalId`
+
+The principal ID of the principal (user/group/identity) to assign the role to.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneGroupName`
+### Parameter: `privateEndpoints.roleAssignments.roleDefinitionIdOrName`
+
+The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+
+- Required: Yes
+- Type: string
 
-Optional. The name of the private DNS zone group to create if privateDnsZoneResourceIds were provided.
+### Parameter: `privateEndpoints.roleAssignments.condition`
+
+The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container"
 
 - Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.privateDnsZoneResourceIds`
+### Parameter: `privateEndpoints.roleAssignments.conditionVersion`
 
-Optional. The private DNS zone groups to associate the private endpoint with. A DNS zone group can support up to 5 DNS zones.
+Version of the condition.
 
 - Required: No
-- Type: array
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    '2.0'
+  ]
+  ```
 
-### Parameter: `privateEndpoints.roleAssignments`
+### Parameter: `privateEndpoints.roleAssignments.delegatedManagedIdentityResourceId`
 
-Optional. Array of role assignments to create.
+The Resource Id of the delegated managed identity resource.
 
 - Required: No
-- Type: array
+- Type: string
 
-### Parameter: `privateEndpoints.service`
+### Parameter: `privateEndpoints.roleAssignments.description`
 
-Required. The service (sub-) type to deploy the private endpoint for. For example "vault" or "blob".
+The description of the role assignment.
 
-- Required: Yes
+- Required: No
 - Type: string
 
-### Parameter: `privateEndpoints.subnetResourceId`
+### Parameter: `privateEndpoints.roleAssignments.principalType`
 
-Required. Resource ID of the subnet where the endpoint needs to be created.
+The principal type of the assigned principal ID.
 
-- Required: Yes
+- Required: No
 - Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Device'
+    'ForeignGroup'
+    'Group'
+    'ServicePrincipal'
+    'User'
+  ]
+  ```
 
 ### Parameter: `privateEndpoints.tags`
 
-Optional. Tags to be applied on all resources/resource groups in this deployment.
+Tags to be applied on all resources/resource groups in this deployment.
 
 - Required: No
 - Type: object
@@ -1554,6 +1616,7 @@ Optional. Tags to be applied on all resources/resource groups in this deployment
 ### Parameter: `publicNetworkAccess`
 
 Whether or not public network access is allowed for this resource. For security reasons it should be disabled. If not specified, it will be disabled by default if private endpoints are set.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -1569,74 +1632,96 @@ Whether or not public network access is allowed for this resource. For security
 ### Parameter: `roleAssignments`
 
 Array of role assignments to create.
+
 - Required: No
 - Type: array
 
+**Required parameters**
 
-| Name | Required | Type | Description |
-| :-- | :-- | :--| :-- |
-| [`condition`](#parameter-roleassignmentscondition) | No | string | Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container" |
-| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | No | string | Optional. Version of the condition. |
-| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | No | string | Optional. The Resource Id of the delegated managed identity resource. |
-| [`description`](#parameter-roleassignmentsdescription) | No | string | Optional. The description of the role assignment. |
-| [`principalId`](#parameter-roleassignmentsprincipalid) | Yes | string | Required. The principal ID of the principal (user/group/identity) to assign the role to. |
-| [`principalType`](#parameter-roleassignmentsprincipaltype) | No | string | Optional. The principal type of the assigned principal ID. |
-| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | Yes | string | Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`principalId`](#parameter-roleassignmentsprincipalid) | string | The principal ID of the principal (user/group/identity) to assign the role to. |
+| [`roleDefinitionIdOrName`](#parameter-roleassignmentsroledefinitionidorname) | string | The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
 
-### Parameter: `roleAssignments.condition`
+**Optional parameters**
 
-Optional. The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container"
+| Parameter | Type | Description |
+| :-- | :-- | :-- |
+| [`condition`](#parameter-roleassignmentscondition) | string | The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container" |
+| [`conditionVersion`](#parameter-roleassignmentsconditionversion) | string | Version of the condition. |
+| [`delegatedManagedIdentityResourceId`](#parameter-roleassignmentsdelegatedmanagedidentityresourceid) | string | The Resource Id of the delegated managed identity resource. |
+| [`description`](#parameter-roleassignmentsdescription) | string | The description of the role assignment. |
+| [`principalType`](#parameter-roleassignmentsprincipaltype) | string | The principal type of the assigned principal ID. |
 
-- Required: No
+### Parameter: `roleAssignments.principalId`
+
+The principal ID of the principal (user/group/identity) to assign the role to.
+
+- Required: Yes
 - Type: string
 
-### Parameter: `roleAssignments.conditionVersion`
+### Parameter: `roleAssignments.roleDefinitionIdOrName`
 
-Optional. Version of the condition.
+The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
 
-- Required: No
+- Required: Yes
 - Type: string
-- Allowed: `[2.0]`
 
-### Parameter: `roleAssignments.delegatedManagedIdentityResourceId`
+### Parameter: `roleAssignments.condition`
 
-Optional. The Resource Id of the delegated managed identity resource.
+The conditions on the role assignment. This limits the resources it can be assigned to. e.g.: @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:ContainerName] StringEqualsIgnoreCase "foo_storage_container"
 
 - Required: No
 - Type: string
 
-### Parameter: `roleAssignments.description`
+### Parameter: `roleAssignments.conditionVersion`
 
-Optional. The description of the role assignment.
+Version of the condition.
 
 - Required: No
 - Type: string
+- Allowed:
+  ```Bicep
+  [
+    '2.0'
+  ]
+  ```
 
-### Parameter: `roleAssignments.principalId`
+### Parameter: `roleAssignments.delegatedManagedIdentityResourceId`
 
-Required. The principal ID of the principal (user/group/identity) to assign the role to.
+The Resource Id of the delegated managed identity resource.
 
-- Required: Yes
+- Required: No
 - Type: string
 
-### Parameter: `roleAssignments.principalType`
+### Parameter: `roleAssignments.description`
 
-Optional. The principal type of the assigned principal ID.
+The description of the role assignment.
 
 - Required: No
 - Type: string
-- Allowed: `[Device, ForeignGroup, Group, ServicePrincipal, User]`
 
-### Parameter: `roleAssignments.roleDefinitionIdOrName`
+### Parameter: `roleAssignments.principalType`
 
-Required. The role to assign. You can provide either the display name of the role definition, the role definition GUID, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'.
+The principal type of the assigned principal ID.
 
-- Required: Yes
+- Required: No
 - Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Device'
+    'ForeignGroup'
+    'Group'
+    'ServicePrincipal'
+    'User'
+  ]
+  ```
 
 ### Parameter: `runbooks`
 
 List of runbooks to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -1644,6 +1729,7 @@ List of runbooks to be created in the automation account.
 ### Parameter: `schedules`
 
 List of schedules to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -1651,6 +1737,7 @@ List of schedules to be created in the automation account.
 ### Parameter: `skuName`
 
 SKU name of the account.
+
 - Required: No
 - Type: string
 - Default: `'Basic'`
@@ -1665,6 +1752,7 @@ SKU name of the account.
 ### Parameter: `softwareUpdateConfigurations`
 
 List of softwareUpdateConfigurations to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -1672,12 +1760,14 @@ List of softwareUpdateConfigurations to be created in the automation account.
 ### Parameter: `tags`
 
 Tags of the Automation Account resource.
+
 - Required: No
 - Type: object
 
 ### Parameter: `variables`
 
 List of variables to be created in the automation account.
+
 - Required: No
 - Type: array
 - Default: `[]`
diff --git a/avm/res/automation/automation-account/job-schedule/README.md b/avm/res/automation/automation-account/job-schedule/README.md
index 694802658a..623aa13d24 100644
--- a/avm/res/automation/automation-account/job-schedule/README.md
+++ b/avm/res/automation/automation-account/job-schedule/README.md
@@ -43,44 +43,50 @@ This module deploys an Azure Automation Account Job Schedule.
 | :-- | :-- | :-- |
 | [`name`](#parameter-name) | string | Name of the Automation Account job schedule. Must be a GUID and is autogenerated. No need to provide this value. |
 
-### Parameter: `automationAccountName`
+### Parameter: `runbookName`
+
+The runbook property associated with the entity.
 
-The name of the parent Automation Account. Required if the template is used in a standalone deployment.
 - Required: Yes
 - Type: string
 
-### Parameter: `name`
+### Parameter: `scheduleName`
 
-Name of the Automation Account job schedule. Must be a GUID and is autogenerated. No need to provide this value.
-- Required: No
+The schedule property associated with the entity.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `automationAccountName`
+
+The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
+- Required: Yes
 - Type: string
-- Default: `[newGuid()]`
 
 ### Parameter: `parameters`
 
 List of job properties.
+
 - Required: No
 - Type: object
 - Default: `{}`
 
-### Parameter: `runbookName`
-
-The runbook property associated with the entity.
-- Required: Yes
-- Type: string
-
 ### Parameter: `runOn`
 
 The hybrid worker group that the scheduled job should run on.
+
 - Required: No
 - Type: string
 - Default: `''`
 
-### Parameter: `scheduleName`
+### Parameter: `name`
 
-The schedule property associated with the entity.
-- Required: Yes
+Name of the Automation Account job schedule. Must be a GUID and is autogenerated. No need to provide this value.
+
+- Required: No
 - Type: string
+- Default: `[newGuid()]`
 
 
 ## Outputs
diff --git a/avm/res/automation/automation-account/module/README.md b/avm/res/automation/automation-account/module/README.md
index cdbed8c772..2b7de3e3d7 100644
--- a/avm/res/automation/automation-account/module/README.md
+++ b/avm/res/automation/automation-account/module/README.md
@@ -38,40 +38,46 @@ This module deploys an Azure Automation Account Module.
 | [`tags`](#parameter-tags) | object | Tags of the Automation Account resource. |
 | [`version`](#parameter-version) | string | Module version or specify latest to get the latest version. |
 
+### Parameter: `name`
+
+Name of the Automation Account module.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `uri`
+
+Module package URI, e.g. https://www.powershellgallery.com/api/v2/package.
+
+- Required: Yes
+- Type: string
+
 ### Parameter: `automationAccountName`
 
 The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
 - Required: Yes
 - Type: string
 
 ### Parameter: `location`
 
 Location for all resources.
+
 - Required: No
 - Type: string
 - Default: `[resourceGroup().location]`
 
-### Parameter: `name`
-
-Name of the Automation Account module.
-- Required: Yes
-- Type: string
-
 ### Parameter: `tags`
 
 Tags of the Automation Account resource.
+
 - Required: No
 - Type: object
 
-### Parameter: `uri`
-
-Module package URI, e.g. https://www.powershellgallery.com/api/v2/package.
-- Required: Yes
-- Type: string
-
 ### Parameter: `version`
 
 Module version or specify latest to get the latest version.
+
 - Required: No
 - Type: string
 - Default: `'latest'`
diff --git a/avm/res/automation/automation-account/runbook/README.md b/avm/res/automation/automation-account/runbook/README.md
index abd7ed483f..22c7d8ffee 100644
--- a/avm/res/automation/automation-account/runbook/README.md
+++ b/avm/res/automation/automation-account/runbook/README.md
@@ -48,22 +48,41 @@ This module deploys an Azure Automation Account Runbook.
 | :-- | :-- | :-- |
 | [`baseTime`](#parameter-basetime) | string | Time used as a basis for e.g. the schedule start date. |
 
-### Parameter: `automationAccountName`
+### Parameter: `name`
+
+Name of the Automation Account runbook.
 
-The name of the parent Automation Account. Required if the template is used in a standalone deployment.
 - Required: Yes
 - Type: string
 
-### Parameter: `baseTime`
+### Parameter: `type`
 
-Time used as a basis for e.g. the schedule start date.
-- Required: No
+The type of the runbook.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Graph'
+    'GraphPowerShell'
+    'GraphPowerShellWorkflow'
+    'PowerShell'
+    'PowerShellWorkflow'
+  ]
+  ```
+
+### Parameter: `automationAccountName`
+
+The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
+- Required: Yes
 - Type: string
-- Default: `[utcNow('u')]`
 
 ### Parameter: `description`
 
 The description of the runbook.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -71,19 +90,15 @@ The description of the runbook.
 ### Parameter: `location`
 
 Location for all resources.
+
 - Required: No
 - Type: string
 - Default: `[resourceGroup().location]`
 
-### Parameter: `name`
-
-Name of the Automation Account runbook.
-- Required: Yes
-- Type: string
-
 ### Parameter: `sasTokenValidityLength`
 
 SAS token validity length. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for 5 days; 'P1Y' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours.
+
 - Required: No
 - Type: string
 - Default: `'PT8H'`
@@ -91,34 +106,21 @@ SAS token validity length. Usage: 'PT8H' - valid for 8 hours; 'P5D' - valid for
 ### Parameter: `scriptStorageAccountResourceId`
 
 Resource Id of the runbook storage account.
+
 - Required: No
 - Type: string
 
 ### Parameter: `tags`
 
 Tags of the Automation Account resource.
+
 - Required: No
 - Type: object
 
-### Parameter: `type`
-
-The type of the runbook.
-- Required: Yes
-- Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Graph'
-    'GraphPowerShell'
-    'GraphPowerShellWorkflow'
-    'PowerShell'
-    'PowerShellWorkflow'
-  ]
-  ```
-
 ### Parameter: `uri`
 
 The uri of the runbook content.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -126,10 +128,19 @@ The uri of the runbook content.
 ### Parameter: `version`
 
 The version of the runbook content.
+
 - Required: No
 - Type: string
 - Default: `''`
 
+### Parameter: `baseTime`
+
+Time used as a basis for e.g. the schedule start date.
+
+- Required: No
+- Type: string
+- Default: `[utcNow('u')]`
+
 
 ## Outputs
 
diff --git a/avm/res/automation/automation-account/schedule/README.md b/avm/res/automation/automation-account/schedule/README.md
index 560e7b214c..3d045753cc 100644
--- a/avm/res/automation/automation-account/schedule/README.md
+++ b/avm/res/automation/automation-account/schedule/README.md
@@ -47,29 +47,32 @@ This module deploys an Azure Automation Account Schedule.
 | :-- | :-- | :-- |
 | [`baseTime`](#parameter-basetime) | string | Time used as a basis for e.g. the schedule start date. |
 
-### Parameter: `advancedSchedule`
+### Parameter: `name`
 
-The properties of the create Advanced Schedule.
-- Required: No
-- Type: object
-- Default: `{}`
+Name of the Automation Account schedule.
+
+- Required: Yes
+- Type: string
 
 ### Parameter: `automationAccountName`
 
 The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
 - Required: Yes
 - Type: string
 
-### Parameter: `baseTime`
+### Parameter: `advancedSchedule`
+
+The properties of the create Advanced Schedule.
 
-Time used as a basis for e.g. the schedule start date.
 - Required: No
-- Type: string
-- Default: `[utcNow('u')]`
+- Type: object
+- Default: `{}`
 
 ### Parameter: `description`
 
 The description of the schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -77,6 +80,7 @@ The description of the schedule.
 ### Parameter: `expiryTime`
 
 The end time of the schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -84,6 +88,7 @@ The end time of the schedule.
 ### Parameter: `frequency`
 
 The frequency of the schedule.
+
 - Required: No
 - Type: string
 - Default: `'OneTime'`
@@ -102,19 +107,15 @@ The frequency of the schedule.
 ### Parameter: `interval`
 
 Anything.
+
 - Required: No
 - Type: int
 - Default: `0`
 
-### Parameter: `name`
-
-Name of the Automation Account schedule.
-- Required: Yes
-- Type: string
-
 ### Parameter: `startTime`
 
 The start time of the schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -122,10 +123,19 @@ The start time of the schedule.
 ### Parameter: `timeZone`
 
 The time zone of the schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
 
+### Parameter: `baseTime`
+
+Time used as a basis for e.g. the schedule start date.
+
+- Required: No
+- Type: string
+- Default: `[utcNow('u')]`
+
 
 ## Outputs
 
diff --git a/avm/res/automation/automation-account/software-update-configuration/README.md b/avm/res/automation/automation-account/software-update-configuration/README.md
index e1c550e23a..fe2ee42c58 100644
--- a/avm/res/automation/automation-account/software-update-configuration/README.md
+++ b/avm/res/automation/automation-account/software-update-configuration/README.md
@@ -70,29 +70,79 @@ This module deploys an Azure Automation Account Software Update Configuration.
 | :-- | :-- | :-- |
 | [`baseTime`](#parameter-basetime) | string | Do not touch. Is used to provide the base time for time comparison for startTime. If startTime is specified in HH:MM format, baseTime is used to check if the provided startTime has passed, adding one day before setting the deployment schedule. |
 
+### Parameter: `frequency`
+
+The frequency of the deployment schedule. When using 'Hour', 'Day', 'Week' or 'Month', an interval needs to be provided.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Day'
+    'Hour'
+    'Month'
+    'OneTime'
+    'Week'
+  ]
+  ```
+
+### Parameter: `name`
+
+The name of the Deployment schedule.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `operatingSystem`
+
+The operating system to be configured by the deployment schedule.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Linux'
+    'Windows'
+  ]
+  ```
+
+### Parameter: `rebootSetting`
+
+Reboot setting for the deployment schedule.
+
+- Required: Yes
+- Type: string
+- Allowed:
+  ```Bicep
+  [
+    'Always'
+    'IfRequired'
+    'Never'
+    'RebootOnly'
+  ]
+  ```
+
 ### Parameter: `automationAccountName`
 
 The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
 - Required: Yes
 - Type: string
 
 ### Parameter: `azureVirtualMachines`
 
 List of azure resource IDs for azure virtual machines in scope for the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
 
-### Parameter: `baseTime`
-
-Do not touch. Is used to provide the base time for time comparison for startTime. If startTime is specified in HH:MM format, baseTime is used to check if the provided startTime has passed, adding one day before setting the deployment schedule.
-- Required: No
-- Type: string
-- Default: `[utcNow('u')]`
-
 ### Parameter: `excludeUpdates`
 
 KB numbers or Linux packages excluded in the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -100,6 +150,7 @@ KB numbers or Linux packages excluded in the deployment schedule.
 ### Parameter: `expiryTime`
 
 The end time of the deployment schedule in ISO 8601 format. YYYY-MM-DDTHH:MM:SS, 2021-12-31T23:00:00.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -107,29 +158,15 @@ The end time of the deployment schedule in ISO 8601 format. YYYY-MM-DDTHH:MM:SS,
 ### Parameter: `expiryTimeOffsetMinutes`
 
 The expiry time's offset in minutes.
+
 - Required: No
 - Type: int
 - Default: `0`
 
-### Parameter: `frequency`
-
-The frequency of the deployment schedule. When using 'Hour', 'Day', 'Week' or 'Month', an interval needs to be provided.
-- Required: Yes
-- Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Day'
-    'Hour'
-    'Month'
-    'OneTime'
-    'Week'
-  ]
-  ```
-
 ### Parameter: `includeUpdates`
 
 KB numbers or Linux packages included in the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -137,6 +174,7 @@ KB numbers or Linux packages included in the deployment schedule.
 ### Parameter: `interval`
 
 The interval of the frequency for the deployment schedule. 1 Hour is every hour, 2 Day is every second day, etc.
+
 - Required: No
 - Type: int
 - Default: `1`
@@ -144,6 +182,7 @@ The interval of the frequency for the deployment schedule. 1 Hour is every hour,
 ### Parameter: `isEnabled`
 
 Enables the deployment schedule.
+
 - Required: No
 - Type: bool
 - Default: `True`
@@ -151,6 +190,7 @@ Enables the deployment schedule.
 ### Parameter: `maintenanceWindow`
 
 Maximum time allowed for the deployment schedule to run. Duration needs to be specified using the format PT[n]H[n]M[n]S as per ISO8601.
+
 - Required: No
 - Type: string
 - Default: `'PT2H'`
@@ -158,6 +198,7 @@ Maximum time allowed for the deployment schedule to run. Duration needs to be sp
 ### Parameter: `monthDays`
 
 Can be used with frequency 'Month'. Provides the specific days of the month to run the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -201,19 +242,15 @@ Can be used with frequency 'Month'. Provides the specific days of the month to r
 ### Parameter: `monthlyOccurrences`
 
 Can be used with frequency 'Month'. Provides the pattern/cadence for running the deployment schedule in a month. Takes objects formed like this {occurance(int),day(string)}. Day is the name of the day to run the deployment schedule, the occurance specifies which occurance of that day to run the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
 
-### Parameter: `name`
-
-The name of the Deployment schedule.
-- Required: Yes
-- Type: string
-
 ### Parameter: `nextRun`
 
 The next time the deployment schedule runs in ISO 8601 format. YYYY-MM-DDTHH:MM:SS, 2021-12-31T23:00:00.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -221,6 +258,7 @@ The next time the deployment schedule runs in ISO 8601 format. YYYY-MM-DDTHH:MM:
 ### Parameter: `nextRunOffsetMinutes`
 
 The next run's offset in minutes.
+
 - Required: No
 - Type: int
 - Default: `0`
@@ -228,6 +266,7 @@ The next run's offset in minutes.
 ### Parameter: `nonAzureComputerNames`
 
 List of names of non-azure machines in scope for the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -235,26 +274,15 @@ List of names of non-azure machines in scope for the deployment schedule.
 ### Parameter: `nonAzureQueries`
 
 Array of functions from a Log Analytics workspace, used to scope the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
 
-### Parameter: `operatingSystem`
-
-The operating system to be configured by the deployment schedule.
-- Required: Yes
-- Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Linux'
-    'Windows'
-  ]
-  ```
-
 ### Parameter: `postTaskParameters`
 
 Parameters provided to the task running after the deployment schedule.
+
 - Required: No
 - Type: object
 - Default: `{}`
@@ -262,6 +290,7 @@ Parameters provided to the task running after the deployment schedule.
 ### Parameter: `postTaskSource`
 
 The source of the task running after the deployment schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -269,6 +298,7 @@ The source of the task running after the deployment schedule.
 ### Parameter: `preTaskParameters`
 
 Parameters provided to the task running before the deployment schedule.
+
 - Required: No
 - Type: object
 - Default: `{}`
@@ -276,28 +306,15 @@ Parameters provided to the task running before the deployment schedule.
 ### Parameter: `preTaskSource`
 
 The source of the task running before the deployment schedule.
+
 - Required: No
 - Type: string
 - Default: `''`
 
-### Parameter: `rebootSetting`
-
-Reboot setting for the deployment schedule.
-- Required: Yes
-- Type: string
-- Allowed:
-  ```Bicep
-  [
-    'Always'
-    'IfRequired'
-    'Never'
-    'RebootOnly'
-  ]
-  ```
-
 ### Parameter: `scheduleDescription`
 
 The schedules description.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -305,6 +322,7 @@ The schedules description.
 ### Parameter: `scopeByLocations`
 
 Specify locations to which to scope the deployment schedule to.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -312,6 +330,7 @@ Specify locations to which to scope the deployment schedule to.
 ### Parameter: `scopeByResources`
 
 Specify the resources to scope the deployment schedule to.
+
 - Required: No
 - Type: array
 - Default:
@@ -324,6 +343,7 @@ Specify the resources to scope the deployment schedule to.
 ### Parameter: `scopeByTags`
 
 Specify tags to which to scope the deployment schedule to.
+
 - Required: No
 - Type: object
 - Default: `{}`
@@ -331,6 +351,7 @@ Specify tags to which to scope the deployment schedule to.
 ### Parameter: `scopeByTagsOperation`
 
 Enables the scopeByTags to require All (Tag A and Tag B) or Any (Tag A or Tag B).
+
 - Required: No
 - Type: string
 - Default: `'All'`
@@ -345,6 +366,7 @@ Enables the scopeByTags to require All (Tag A and Tag B) or Any (Tag A or Tag B)
 ### Parameter: `startTime`
 
 The start time of the deployment schedule in ISO 8601 format. To specify a specific time use YYYY-MM-DDTHH:MM:SS, 2021-12-31T23:00:00. For schedules where we want to start the deployment as soon as possible, specify the time segment only in 24 hour format, HH:MM, 22:00.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -352,6 +374,7 @@ The start time of the deployment schedule in ISO 8601 format. To specify a speci
 ### Parameter: `timeZone`
 
 Time zone for the deployment schedule. IANA ID or a Windows Time Zone ID.
+
 - Required: No
 - Type: string
 - Default: `'UTC'`
@@ -359,6 +382,7 @@ Time zone for the deployment schedule. IANA ID or a Windows Time Zone ID.
 ### Parameter: `updateClassifications`
 
 Update classification included in the deployment schedule.
+
 - Required: No
 - Type: array
 - Default:
@@ -386,6 +410,7 @@ Update classification included in the deployment schedule.
 ### Parameter: `weekDays`
 
 Required when used with frequency 'Week'. Specified the day of the week to run the deployment schedule.
+
 - Required: No
 - Type: array
 - Default: `[]`
@@ -402,6 +427,14 @@ Required when used with frequency 'Week'. Specified the day of the week to run t
   ]
   ```
 
+### Parameter: `baseTime`
+
+Do not touch. Is used to provide the base time for time comparison for startTime. If startTime is specified in HH:MM format, baseTime is used to check if the provided startTime has passed, adding one day before setting the deployment schedule.
+
+- Required: No
+- Type: string
+- Default: `[utcNow('u')]`
+
 
 ## Outputs
 
diff --git a/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep b/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
index a8c49a9527..9105a9bdf3 100644
--- a/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
+++ b/avm/res/automation/automation-account/tests/e2e/waf-aligned/main.test.bicep
@@ -72,20 +72,9 @@ module testDeployment '../../../main.bicep' = [for iteration in [ 'init', 'idem'
       eventHubAuthorizationRuleResourceId: diagnosticDependencies.outputs.eventHubAuthorizationRuleId
       storageAccountResourceId: diagnosticDependencies.outputs.storageAccountResourceId
       workspaceResourceId: diagnosticDependencies.outputs.logAnalyticsWorkspaceResourceId
-      metricCategories: [
-        {
-          category: 'AllMetrics'
-        }
-      ]
       logCategoriesAndGroups: [
         {
-          category: 'JobLogs'
-        }
-        {
-          category: 'JobStreams'
-        }
-        {
-          category: 'DSCNodeStatus'
+          categoryGroup: 'AllLogs'
         }
       ]
     }
diff --git a/avm/res/automation/automation-account/variable/README.md b/avm/res/automation/automation-account/variable/README.md
index 60e939051d..48b92eeef9 100644
--- a/avm/res/automation/automation-account/variable/README.md
+++ b/avm/res/automation/automation-account/variable/README.md
@@ -37,15 +37,31 @@ This module deploys an Azure Automation Account Variable.
 | [`description`](#parameter-description) | string | The description of the variable. |
 | [`isEncrypted`](#parameter-isencrypted) | bool | If the variable should be encrypted. For security reasons encryption of variables should be enabled. |
 
+### Parameter: `name`
+
+The name of the variable.
+
+- Required: Yes
+- Type: string
+
+### Parameter: `value`
+
+The value of the variable. For security best practices, this value is always passed as a secure string as it could contain an encrypted value when the "isEncrypted" property is set to true.
+
+- Required: Yes
+- Type: securestring
+
 ### Parameter: `automationAccountName`
 
 The name of the parent Automation Account. Required if the template is used in a standalone deployment.
+
 - Required: Yes
 - Type: string
 
 ### Parameter: `description`
 
 The description of the variable.
+
 - Required: No
 - Type: string
 - Default: `''`
@@ -53,22 +69,11 @@ The description of the variable.
 ### Parameter: `isEncrypted`
 
 If the variable should be encrypted. For security reasons encryption of variables should be enabled.
+
 - Required: No
 - Type: bool
 - Default: `True`
 
-### Parameter: `name`
-
-The name of the variable.
-- Required: Yes
-- Type: string
-
-### Parameter: `value`
-
-The value of the variable. For security best practices, this value is always passed as a secure string as it could contain an encrypted value when the "isEncrypted" property is set to true.
-- Required: Yes
-- Type: securestring
-
 
 ## Outputs