diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
index a84b8c1..266314e 100644
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -54,7 +54,7 @@ jobs:
       - name: Set up go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
         with:
-          check-latest: true
+          go-version: 'stable'
 
       - name: Install alzlibtool
         run: go install github.com/Azure/alzlib/cmd/alzlibtool@v0.18.0
diff --git a/.github/workflows/update-alz.yml b/.github/workflows/update-alz.yml
index 45f5739..8b5bbf9 100644
--- a/.github/workflows/update-alz.yml
+++ b/.github/workflows/update-alz.yml
@@ -40,6 +40,8 @@ jobs:
 
       - name: setup go
         uses: actions/setup-go@cdcb36043654635271a94b9a6d1392de5bb323a7 # v5.0.1
+        with:
+          go-version: 'stable'
 
       - name: install alzlibtool
         run: go install github.com/Azure/alzlib/cmd/alzlibtool@v0.18.0
@@ -83,7 +85,7 @@ jobs:
         with:
           inlineScript: |
             Write-Information "==> Running policy assignments and archetypes script..." -InformationAction Continue
-            ${{ github.repository }}/.github/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1 `
+            ${{ github.repository }}/platform/alz/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1 `
               -AlzToolsPath "${{ github.workspace }}/${{ env.remote_repository }}/src/Alz.Tools/" `
               -TargetPath "${{ github.workspace }}/${{ github.repository }}" `
               -SourcePath "${{ github.workspace }}/${{ env.remote_repository }}"
diff --git a/platform/alz/README.md b/platform/alz/README.md
index 12f865e..a165ae8 100644
--- a/platform/alz/README.md
+++ b/platform/alz/README.md
@@ -17,9 +17,9 @@ provider "alz" {
   
 ## Architectures
   
-The following architectures are available in this library:
+The following architectures are available in this library, please note that the diagrams denote the management group display name and, in brackets, the associated archetypes:
   
-### `alz`
+### architecture `alz`
   
 > [!NOTE]  
 > This hierarchy will be deployed as a child of the user-supplied root management group.
@@ -50,18 +50,18 @@ flowchart TD
   
 ## Archetypes
   
-### `connectivity`
+### archetype `connectivity`
   
-#### Policy Assignments
+#### connectivity policy assignments
   
 <details><summary>1 policy assignments</summary>
 
 - Enable-DDoS-VNET
 </details>
   
-### `corp`
+### archetype `corp`
   
-#### Policy Assignments
+#### corp policy assignments
   
 <details><summary>5 policy assignments</summary>
 
@@ -72,18 +72,18 @@ flowchart TD
 - Deploy-Private-DNS-Zones
 </details>
   
-### `decommissioned`
+### archetype `decommissioned`
   
-#### Policy Assignments
+#### decommissioned policy assignments
   
 <details><summary>1 policy assignments</summary>
 
 - Enforce-ALZ-Decomm
 </details>
   
-### `identity`
+### archetype `identity`
   
-#### Policy Assignments
+#### identity policy assignments
   
 <details><summary>4 policy assignments</summary>
 
@@ -93,9 +93,9 @@ flowchart TD
 - Deploy-VM-Backup
 </details>
   
-### `landing_zones`
+### archetype `landing_zones`
   
-#### Policy Assignments
+#### landing_zones policy assignments
   
 <details><summary>25 policy assignments</summary>
 
@@ -126,18 +126,18 @@ flowchart TD
 - Enforce-TLS-SSL-H224
 </details>
   
-### `management`
+### archetype `management`
   
-#### Policy Assignments
+#### management policy assignments
   
 <details><summary>1 policy assignments</summary>
 
 - Deploy-Log-Analytics
 </details>
   
-### `platform`
+### archetype `platform`
   
-#### Policy Assignments
+#### platform policy assignments
   
 <details><summary>11 policy assignments</summary>
 
@@ -154,9 +154,9 @@ flowchart TD
 - Enforce-GR-KeyVault
 </details>
   
-### `root`
+### archetype `root`
   
-#### Policy Definitions
+#### root policy definitions
   
 <details><summary>158 policy definitions</summary>
 
@@ -320,7 +320,7 @@ flowchart TD
 - Modify-UDR
 </details>
   
-#### Policy Set Definitions
+#### root policy set definitions
   
 <details><summary>45 policy set definitions</summary>
 
@@ -371,7 +371,7 @@ flowchart TD
 - Enforce-Guardrails-VirtualDesktop
 </details>
   
-#### Policy Assignments
+#### root policy assignments
   
 <details><summary>15 policy assignments</summary>
 
@@ -392,7 +392,7 @@ flowchart TD
 - Enforce-ACSB
 </details>
   
-#### Role Definitions
+#### root role definitions
   
 <details><summary>5 role definitions</summary>
 
@@ -403,19 +403,720 @@ flowchart TD
 - Subscription-Owner
 </details>
   
-### `sandboxes`
+### archetype `sandboxes`
   
-#### Policy Assignments
+#### sandboxes policy assignments
   
 <details><summary>1 policy assignments</summary>
 
 - Enforce-ALZ-Sandbox
 </details>
   
+## Policy Default Values
+  
+The following policy default values are available in this library:
+  
+### default name `ama_user_assigned_managed_identity_id`
+  
+#### assignment `Deploy-VM-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- userAssignedIdentityResourceId
+</details>
+  
+#### assignment `Deploy-vmArc-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- userAssignedIdentityResourceId
+</details>
+  
+#### assignment `Deploy-VMSS-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- userAssignedIdentityResourceId
+</details>
+  
+### default name `ama_user_assigned_managed_identity_name`
+  
+#### assignment `DenyAction-DeleteUAMIAMA`
+  
+<details><summary>1 parameter names</summary>
+
+- resourceName
+</details>
+  
+### default name `ama_vm_change_tracking_data_collection_rule_id`
+  
+#### assignment `Deploy-VM-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- dcrResourceId
+</details>
+  
+### default name `ama_vmarc_change_tracking_data_collection_rule_id`
+  
+#### assignment `Deploy-vmArc-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- dcrResourceId
+</details>
+  
+### default name `ama_vmss_change_tracking_data_collection_rule_id`
+  
+#### assignment `Deploy-VMSS-ChangeTrack`
+  
+<details><summary>1 parameter names</summary>
+
+- dcrResourceId
+</details>
+  
+### default name `automation_account_location`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- automationRegion
+</details>
+  
+### default name `automation_account_name`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- automationAccountName
+</details>
+  
+### default name `ddos_protection_plan_id`
+  
+#### assignment `Enable-DDoS-VNET`
+  
+<details><summary>1 parameter names</summary>
+
+- ddosPlan
+</details>
+  
+### default name `log_analytics_workspace_id`
+  
+#### assignment `Deploy-AzActivity-Log`
+  
+<details><summary>1 parameter names</summary>
+
+- logAnalytics
+</details>
+  
+#### assignment `Deploy-AzSqlDb-Auditing`
+  
+<details><summary>1 parameter names</summary>
+
+- logAnalyticsWorkspaceId
+</details>
+  
+#### assignment `Deploy-Diag-Logs`
+  
+<details><summary>1 parameter names</summary>
+
+- logAnalytics
+</details>
+  
+#### assignment `Deploy-MDFC-Config-H224`
+  
+<details><summary>1 parameter names</summary>
+
+- logAnalytics
+</details>
+  
+#### assignment `Deploy-MDFC-Config`
+  
+<details><summary>1 parameter names</summary>
+
+- logAnalytics
+</details>
+  
+#### assignment `Deploy-MDFC-DefSQL-AMA`
+  
+<details><summary>1 parameter names</summary>
+
+- userWorkspaceResourceId
+</details>
+  
+### default name `log_analytics_workspace_location`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- workspaceRegion
+</details>
+  
+### default name `log_analytics_workspace_name`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- workspaceName
+</details>
+  
+### default name `log_analytics_workspace_resource_group_name`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- rgName
+</details>
+  
+### default name `log_analytics_workspace_retention_in_days`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- dataRetention
+</details>
+  
+### default name `log_analytics_workspace_sku`
+  
+#### assignment `Deploy-Log-Analytics`
+  
+<details><summary>1 parameter names</summary>
+
+- sku
+</details>
+  
+### default name `private_dns_zone_app`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureAppPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_app_services`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureAppServicesPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_arc_guestconfiguration`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureArcGuestconfigurationPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_arc_hybrid_resource_provider`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureArcHybridResourceProviderPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_arc_kubernetes_configuration`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureArcKubernetesConfigurationPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_asr`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureAsrPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_automation_dsc_hybrid`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureAutomationDSCHybridPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_automation_webhook`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureAutomationWebhookPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_batch`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureBatchPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cognitive_search`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCognitiveSearchPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cognitive_services`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCognitiveServicesPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cosmos_cassandra`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCosmosCassandraPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cosmos_gremlin`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCosmosGremlinPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cosmos_mongo`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCosmosMongoPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cosmos_sql`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCosmosSQLPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_cosmos_table`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureCosmosTablePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_data_factory`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureDataFactoryPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_data_factory_portal`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureDataFactoryPortalPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_disk_access`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureDiskAccessPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_event_grid_domains`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureEventGridDomainsPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_event_grid_topics`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureEventGridTopicsPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_event_hub_namespace`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureEventHubNamespacePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_file`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureFilePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_hdinsight`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureHDInsightPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_iot`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureIotPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_iot_hubs`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureIotHubsPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_key_vault`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureKeyVaultPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_machine_learning_workspace`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMachineLearningWorkspacePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_managed_grafana_workspace`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureManagedGrafanaWorkspacePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_media_services_key`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMediaServicesKeyPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_media_services_live`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMediaServicesLivePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_media_services_stream`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMediaServicesStreamPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_migrate`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMigratePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_monitor_1`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMonitorPrivateDnsZoneId1
+</details>
+  
+### default name `private_dns_zone_monitor_2`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMonitorPrivateDnsZoneId2
+</details>
+  
+### default name `private_dns_zone_monitor_3`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMonitorPrivateDnsZoneId3
+</details>
+  
+### default name `private_dns_zone_monitor_4`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMonitorPrivateDnsZoneId4
+</details>
+  
+### default name `private_dns_zone_monitor_5`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureMonitorPrivateDnsZoneId5
+</details>
+  
+### default name `private_dns_zone_redis_cache`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureRedisCachePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_service_bus_namespace`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureServiceBusNamespacePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_signal_r`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSignalRPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_site_recovery_blob`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSiteRecoveryBlobPrivateDnsZoneID
+</details>
+  
+### default name `private_dns_zone_site_recovery_queue`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSiteRecoveryQueuePrivateDnsZoneID
+</details>
+  
+### default name `private_dns_zone_storage_blob`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageBlobPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_blob_sec`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageBlobSecPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_dfs`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageDFSPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_dfs_sec`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageDFSSecPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_file`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageFilePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_queue`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageQueuePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_queue_sec`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageQueueSecPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_static_web`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageStaticWebPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_storage_static_web_sec`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureStorageStaticWebSecPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_synapse_dev`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSynapseDevPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_synapse_sql`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSynapseSQLPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_synapse_sql_od`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureSynapseSQLODPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_virtual_desktop_hostpool`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureVirtualDesktopHostpoolPrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_virtual_desktop_workspace`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureVirtualDesktopWorkspacePrivateDnsZoneId
+</details>
+  
+### default name `private_dns_zone_web`
+  
+#### assignment `Deploy-Private-DNS-Zones`
+  
+<details><summary>1 parameter names</summary>
+
+- azureWebPrivateDnsZoneId
+</details>
+  
 ---
 ## Contents
   
-### Policy Definitions
+### all policy definitions
   
 <details><summary>158 policy definitions</summary>
 
@@ -579,7 +1280,7 @@ flowchart TD
 - Modify-UDR
 </details>
   
-### Policy Set Definitions
+### all policy set definitions
   
 <details><summary>45 policy set definitions</summary>
 
@@ -630,7 +1331,7 @@ flowchart TD
 - Enforce-Guardrails-VirtualDesktop
 </details>
   
-### Policy Assignments
+### all policy assignments
   
 <details><summary>69 policy assignments</summary>
 
@@ -705,7 +1406,7 @@ flowchart TD
 - Enforce-TLS-SSL-H224
 </details>
   
-### Role Definitions
+### all role definitions
   
 <details><summary>5 role definitions</summary>
 
diff --git a/platform/alz/policy_assignment_default_values/alz_policy_default_values.json b/platform/alz/policy_assignment_default_values/alz_policy_default_values.json
new file mode 100644
index 0000000..1661146
--- /dev/null
+++ b/platform/alz/policy_assignment_default_values/alz_policy_default_values.json
@@ -0,0 +1,839 @@
+{
+  "$schema": "https://raw.githubusercontent.com/Azure/Azure-Landing-Zones-Library/main/schemas/default_policy_values.json",
+  "defaults": [
+    {
+      "default_name": "ama_user_assigned_managed_identity_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "userAssignedIdentityResourceId"
+          ],
+          "policy_assignment_name": "Deploy-VM-ChangeTrack"
+        },
+        {
+          "parameter_names": [
+            "userAssignedIdentityResourceId"
+          ],
+          "policy_assignment_name": "Deploy-vmArc-ChangeTrack"
+        },
+        {
+          "parameter_names": [
+            "userAssignedIdentityResourceId"
+          ],
+          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
+        }
+      ]
+    },
+    {
+      "default_name": "ama_user_assigned_managed_identity_name",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "resourceName"
+          ],
+          "policy_assignment_name": "DenyAction-DeleteUAMIAMA"
+        }
+      ]
+    },
+    {
+      "default_name": "ama_vm_change_tracking_data_collection_rule_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "dcrResourceId"
+          ],
+          "policy_assignment_name": "Deploy-VM-ChangeTrack"
+        }
+      ]
+    },
+    {
+      "default_name": "ama_vmarc_change_tracking_data_collection_rule_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "dcrResourceId"
+          ],
+          "policy_assignment_name": "Deploy-vmArc-ChangeTrack"
+        }
+      ]
+    },
+    {
+      "default_name": "ama_vmss_change_tracking_data_collection_rule_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "dcrResourceId"
+          ],
+          "policy_assignment_name": "Deploy-VMSS-ChangeTrack"
+        }
+      ]
+    },
+    {
+      "default_name": "automation_account_location",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "automationRegion"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "automation_account_name",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "automationAccountName"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "ddos_protection_plan_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "ddosPlan"
+          ],
+          "policy_assignment_name": "Enable-DDoS-VNET"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_id",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "logAnalytics"
+          ],
+          "policy_assignment_name": "Deploy-AzActivity-Log"
+        },
+        {
+          "parameter_names": [
+            "logAnalyticsWorkspaceId"
+          ],
+          "policy_assignment_name": "Deploy-AzSqlDb-Auditing"
+        },
+        {
+          "parameter_names": [
+            "logAnalytics"
+          ],
+          "policy_assignment_name": "Deploy-Diag-Logs"
+        },
+        {
+          "parameter_names": [
+            "logAnalytics"
+          ],
+          "policy_assignment_name": "Deploy-MDFC-Config-H224"
+        },
+        {
+          "parameter_names": [
+            "logAnalytics"
+          ],
+          "policy_assignment_name": "Deploy-MDFC-Config"
+        },
+        {
+          "parameter_names": [
+            "userWorkspaceResourceId"
+          ],
+          "policy_assignment_name": "Deploy-MDFC-DefSQL-AMA"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_location",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "workspaceRegion"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_name",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "workspaceName"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_resource_group_name",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "rgName"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_retention_in_days",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "dataRetention"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "log_analytics_workspace_sku",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "sku"
+          ],
+          "policy_assignment_name": "Deploy-Log-Analytics"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_managed_grafana_workspace",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureManagedGrafanaWorkspacePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_arc_kubernetes_configuration",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureArcKubernetesConfigurationPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_arc_hybrid_resource_provider",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureArcHybridResourceProviderPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_arc_guestconfiguration",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureArcGuestconfigurationPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_app",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureAppPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_app_services",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureAppServicesPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_asr",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureAsrPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_automation_dsc_hybrid",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureAutomationDSCHybridPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_automation_webhook",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureAutomationWebhookPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_batch",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureBatchPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cognitive_search",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCognitiveSearchPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cognitive_services",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCognitiveServicesPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cosmos_cassandra",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCosmosCassandraPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cosmos_gremlin",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCosmosGremlinPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cosmos_mongo",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCosmosMongoPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cosmos_sql",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCosmosSQLPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_cosmos_table",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureCosmosTablePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_data_factory_portal",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureDataFactoryPortalPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_data_factory",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureDataFactoryPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_disk_access",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureDiskAccessPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_event_grid_domains",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureEventGridDomainsPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_event_grid_topics",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureEventGridTopicsPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_event_hub_namespace",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureEventHubNamespacePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_file",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureFilePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_hdinsight",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureHDInsightPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_iot_hubs",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureIotHubsPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_iot",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureIotPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_key_vault",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureKeyVaultPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_machine_learning_workspace",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMachineLearningWorkspacePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_media_services_key",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMediaServicesKeyPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_media_services_live",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMediaServicesLivePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_media_services_stream",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMediaServicesStreamPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_migrate",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMigratePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_monitor_1",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMonitorPrivateDnsZoneId1"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_monitor_2",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMonitorPrivateDnsZoneId2"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_monitor_3",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMonitorPrivateDnsZoneId3"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_monitor_4",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMonitorPrivateDnsZoneId4"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_monitor_5",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureMonitorPrivateDnsZoneId5"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_redis_cache",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureRedisCachePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_service_bus_namespace",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureServiceBusNamespacePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_signal_r",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSignalRPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_blob",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageBlobPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_blob_sec",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageBlobSecPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_dfs",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageDFSPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_dfs_sec",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageDFSSecPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_file",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageFilePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_queue",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageQueuePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_queue_sec",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageQueueSecPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_static_web",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageStaticWebPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_storage_static_web_sec",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureStorageStaticWebSecPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_synapse_dev",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSynapseDevPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_synapse_sql_od",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSynapseSQLODPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_synapse_sql",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSynapseSQLPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_web",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureWebPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_virtual_desktop_hostpool",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureVirtualDesktopHostpoolPrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_virtual_desktop_workspace",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureVirtualDesktopWorkspacePrivateDnsZoneId"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_site_recovery_blob",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSiteRecoveryBlobPrivateDnsZoneID"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    },
+    {
+      "default_name": "private_dns_zone_site_recovery_queue",
+      "policy_assignments": [
+        {
+          "parameter_names": [
+            "azureSiteRecoveryQueuePrivateDnsZoneID"
+          ],
+          "policy_assignment_name": "Deploy-Private-DNS-Zones"
+        }
+      ]
+    }
+  ]
+}
diff --git a/platform/alz/policy_assignments/denyaction_deleteuamiama.alz_policy_assignment.json b/platform/alz/policy_assignments/denyaction_deleteuamiama.alz_policy_assignment.json
index d971523..83321cb 100644
--- a/platform/alz/policy_assignments/denyaction_deleteuamiama.alz_policy_assignment.json
+++ b/platform/alz/policy_assignments/denyaction_deleteuamiama.alz_policy_assignment.json
@@ -16,7 +16,7 @@
         "value": "defaultString3"
       },
       "resourceType": {
-        "value": "defaultString4"
+        "value": "Microsoft.ManagedIdentity/userAssignedIdentities"
       }
     },
     "scope": "/providers/Microsoft.Management/managementGroups/placeholder",
diff --git a/platform/alz/scripts/CreatePrivateDnsZoneDefaultArray.ps1 b/platform/alz/scripts/CreatePrivateDnsZoneDefaultArray.ps1
new file mode 100644
index 0000000..e4f396a
--- /dev/null
+++ b/platform/alz/scripts/CreatePrivateDnsZoneDefaultArray.ps1
@@ -0,0 +1,100 @@
+$privateDnsZoneIds = @(
+  "azureManagedGrafanaWorkspacePrivateDnsZoneId",
+  "azureArcKubernetesConfigurationPrivateDnsZoneId",
+  "azureArcHybridResourceProviderPrivateDnsZoneId",
+  "azureArcGuestconfigurationPrivateDnsZoneId",
+  "azureAppPrivateDnsZoneId",
+  "azureAppServicesPrivateDnsZoneId",
+  "azureAsrPrivateDnsZoneId",
+  "azureAutomationDSCHybridPrivateDnsZoneId",
+  "azureAutomationWebhookPrivateDnsZoneId",
+  "azureBatchPrivateDnsZoneId",
+  "azureCognitiveSearchPrivateDnsZoneId",
+  "azureCognitiveServicesPrivateDnsZoneId",
+  "azureCosmosCassandraPrivateDnsZoneId",
+  "azureCosmosGremlinPrivateDnsZoneId",
+  "azureCosmosMongoPrivateDnsZoneId",
+  "azureCosmosSQLPrivateDnsZoneId",
+  "azureCosmosTablePrivateDnsZoneId",
+  "azureDataFactoryPortalPrivateDnsZoneId",
+  "azureDataFactoryPrivateDnsZoneId",
+  "azureDiskAccessPrivateDnsZoneId",
+  "azureEventGridDomainsPrivateDnsZoneId",
+  "azureEventGridTopicsPrivateDnsZoneId",
+  "azureEventHubNamespacePrivateDnsZoneId",
+  "azureFilePrivateDnsZoneId",
+  "azureHDInsightPrivateDnsZoneId",
+  "azureIotHubsPrivateDnsZoneId",
+  "azureIotPrivateDnsZoneId",
+  "azureKeyVaultPrivateDnsZoneId",
+  "azureMachineLearningWorkspacePrivateDnsZoneId",
+  "azureMediaServicesKeyPrivateDnsZoneId",
+  "azureMediaServicesLivePrivateDnsZoneId",
+  "azureMediaServicesStreamPrivateDnsZoneId",
+  "azureMigratePrivateDnsZoneId",
+  "azureMonitorPrivateDnsZoneId1",
+  "azureMonitorPrivateDnsZoneId2",
+  "azureMonitorPrivateDnsZoneId3",
+  "azureMonitorPrivateDnsZoneId4",
+  "azureMonitorPrivateDnsZoneId5",
+  "azureRedisCachePrivateDnsZoneId",
+  "azureServiceBusNamespacePrivateDnsZoneId",
+  "azureSignalRPrivateDnsZoneId",
+  "azureStorageBlobPrivateDnsZoneId",
+  "azureStorageBlobSecPrivateDnsZoneId",
+  "azureStorageDFSPrivateDnsZoneId",
+  "azureStorageDFSSecPrivateDnsZoneId",
+  "azureStorageFilePrivateDnsZoneId",
+  "azureStorageQueuePrivateDnsZoneId",
+  "azureStorageQueueSecPrivateDnsZoneId",
+  "azureStorageStaticWebPrivateDnsZoneId",
+  "azureStorageStaticWebSecPrivateDnsZoneId",
+  "azureSynapseDevPrivateDnsZoneId",
+  "azureSynapseSQLODPrivateDnsZoneId",
+  "azureSynapseSQLPrivateDnsZoneId",
+  "azureWebPrivateDnsZoneId",
+  "azureVirtualDesktopHostpoolPrivateDnsZoneId",
+  "azureVirtualDesktopWorkspacePrivateDnsZoneId",
+  "azureSiteRecoveryBlobPrivateDnsZoneID",
+  "azureSiteRecoveryQueuePrivateDnsZoneID"
+)
+
+$results = @()
+
+foreach ($privateDnsZoneId in $privateDnsZoneIds) {
+  $camelCase = ""
+  $wasPreviousUpperI = $false
+
+  foreach ($character in $privateDnsZoneId.ToCharArray()) {
+    if ([System.Char]::IsUpper($character)) {
+      if (!$wasPreviousUpper) {
+        $camelCase += "_"
+      }
+
+      $wasPreviousUpper = $true
+    }
+    else {
+      $wasPreviousUpper = $false
+    }
+    $camelCase += $character.ToString().ToLower()
+  }
+
+  $camelCase = $camelCase.Replace("sql", "_sql_").Replace("dfs", "_dfs_").Replace("dsc", "_dsc_").Replace("signal_r", "_signal_r_").Replace("private_dns_zone_id", "_private_dns_zone_id_").Replace("___", "_").Replace("__", "_").Trim("_")
+  $finalName = $camelCase.Replace("_private_dns_zone_id", "").Replace("azure_", "").Trim("_")
+  $finalName = "private_dns_zone_$finalName"
+
+  $jsonObject = @{
+    "default_name"       = $finalName
+    "policy_assignments" = @(
+      @{
+        "policy_assignment_name" = "Deploy-Private-DNS-Zones"
+        "parameter_names"        = @(
+          $privateDnsZoneId
+        )
+      }
+    )
+  }
+  $results += $jsonObject
+}
+
+Write-Output $results | ConvertTo-Json -Depth 10
diff --git a/.github/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1 b/platform/alz/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1
similarity index 99%
rename from .github/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1
rename to platform/alz/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1
index 115f87e..f85a04b 100644
--- a/.github/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1
+++ b/platform/alz/scripts/Invoke-LibraryUpdatePolicyAssignmentArchetypes.ps1
@@ -102,6 +102,7 @@ $parameters = @{
         userAssignedIdentityResourceId           = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder/providers/Microsoft.ManagedIdentity/userAssignedIdentities/placeholder"
         dcrResourceId                            = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder/providers/Microsoft.Insights/dataCollectionRules/placeholder"
         dataCollectionRuleResourceId             = "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/placeholder/providers/Microsoft.Insights/dataCollectionRules/placeholder"
+        resourceType                             = "Microsoft.ManagedIdentity/userAssignedIdentities"
     }
     overrides = @{
         sql_data_collection_rule_overrides             = @{
diff --git a/.github/scripts/Invoke-LibraryUpdatePolicyDefinitions.ps1 b/platform/alz/scripts/Invoke-LibraryUpdatePolicyDefinitions.ps1
similarity index 100%
rename from .github/scripts/Invoke-LibraryUpdatePolicyDefinitions.ps1
rename to platform/alz/scripts/Invoke-LibraryUpdatePolicyDefinitions.ps1