fix: downmerge from main to dev

.github/CODEOWNERS

@@ -2,4 +2,4 @@
 # Each line is a file pattern followed by one or more owners.
 
 # These owners will be the default owners for everything in the repo.
-* @Avijit-Microsoft @Roopan-Microsoft @Prajwal1-Microsoft @aniaroramsft @marktayl1 @VinaySh-Microsoft @toherman-msft @nchandhi @dgp10801
+* @Avijit-Microsoft @Roopan-Microsoft @Prajwal-Microsoft @aniaroramsft @marktayl1 @Vinay-Microsoft @toherman-msft @nchandhi @dgp10801

docs/AzureGPTQuotaSettings.md

@@ -5,6 +5,6 @@
 3. **Go to** the `Management Center` from the bottom-left navigation menu.  
 4. Select `Quota`  
    - Click on the `GlobalStandard` dropdown.  
-   - Select the required **GPT model** (`GPT-4, GPT-4o`).  
+   - Select the required **GPT model** (`GPT-5.1`).
    - Choose the **region** where the deployment is hosted.  
 5. Request More Quota or delete any unused model deployments as needed.  

docs/CustomizingAzdParameters.md

@@ -12,7 +12,7 @@ By default this template will use the environment name as the prefix to prevent
 | `AZURE_LOCATION`                       | string  | `<User selects during deployment>`      | Location of the Azure resources. Controls where the infrastructure will be deployed.                 |
 | `AZURE_ENV_AI_SERVICE_LOCATION`        | string  | `<User selects during deployment>`     | Location of the Azure resources. Controls where the Azure AI Services will be deployed. |
 | `AZURE_ENV_MODEL_DEPLOYMENT_TYPE`      | string  | `GlobalStandard` | Change the Model Deployment Type (allowed values: Standard, GlobalStandard).                         |
-| `AZURE_ENV_GPT_MODEL_NAME`             | string  | `gpt-5.1`         | Set the Model Name (allowed values: gpt-5.1).                                                         |
+| `AZURE_ENV_GPT_MODEL_NAME`             | string  | `gpt-5.1`         | Set the Model Name (default: gpt-5.1).                                                               |
 | `AZURE_ENV_GPT_MODEL_VERSION`          | string  | `2025-11-13`     | Set the Azure model version (allowed values: 2025-11-13)    |
 | `AZURE_ENV_GPT_MODEL_CAPACITY`         | integer | `150`            | Set the Model Capacity (choose a number based on available GPT model capacity in your subscription). |
 | `AZURE_ENV_EXISTING_LOG_ANALYTICS_WORKSPACE_RID`| string  | Guide to get your [Existing Workspace ID](re-use-log-analytics.md)     | Set this if you want to reuse an existing Log Analytics Workspace instead of creating a new one.     |

docs/EXAMPLE-CustomizingAzdParameters.md

@@ -17,10 +17,10 @@ Change the Model Deployment Type (allowed values: Standard, GlobalStandard)
 azd env set AZURE_ENV_MODEL_DEPLOYMENT_TYPE GlobalStandard
 ```
 
-Set the Model Name (allowed values: gpt-4o)
+Set the Model Name (default: gpt-5.1)
 
 ```shell
-azd env set AZURE_ENV_MODEL_NAME gpt-4o
+azd env set AZURE_ENV_GPT_MODEL_NAME gpt-5.1
 ```
 
 Change the Model Capacity (choose a number based on available GPT model capacity in your subscription)

docs/quota_check.md

@@ -1,7 +1,7 @@
 ## Check Quota Availability Before Deployment
 
 Before deploying the accelerator, **ensure sufficient quota availability** for the required model.
-> **For Global Standard | GPT-4o - the capacity to at least 200K tokens for optimal performance.**
+> **For Global Standard | GPT-5.1 - ensure capacity is at least 200K tokens for optimal performance.**
 
 ### Login if you have not done so already
 ```
@@ -14,7 +14,7 @@ az login --use-device-code
 
 ### 📌 Default Models & Capacities:
 ```
-gpt-4o:150
+gpt-5.1:150
 ```
 ### 📌 Default Regions:
 ```
@@ -40,15 +40,15 @@ eastus, uksouth, eastus2, northcentralus, swedencentral, westus, westus2, southc
    ```
 ✔️ Check specific model(s) in default regions:
   ```
-  ./quota_check_params.sh --models gpt-4o:150
+  ./quota_check_params.sh --models gpt-5.1:150
   ```
 ✔️ Check default models in specific region(s):
   ```
 ./quota_check_params.sh --regions eastus,westus
   ```
 ✔️ Passing Both models and regions:  
   ```
-  ./quota_check_params.sh --models gpt-4o:150 --regions eastus,westus2
+  ./quota_check_params.sh --models gpt-5.1:150 --regions eastus,westus2
   ```
 ✔️ All parameters combined:
   ```

infra/main.bicep

@@ -334,6 +334,7 @@ var privateDnsZones = [
   'privatelink.oms.opinsights.azure.com'                 // Log Analytics OMS endpoints
   'privatelink.ods.opinsights.azure.com'                 // Log Analytics ODS ingestion endpoints
   'privatelink.agentsvc.azure-automation.net'             // Agent service automation endpoints
+  'privatelink.azurecr.io'                               // Azure Container Registry
 ]
 
 // DNS Zone Index Constants
@@ -348,6 +349,7 @@ var dnsZoneIndex = {
   oms: 7
   ods: 8
   agentSvc: 9
+  containerRegistry: 10
 }
 
 // ===================================================
@@ -902,15 +904,16 @@ module cosmosDb 'modules/cosmosDb.bicep' = {
 // and then updates the container apps to run the freshly built images.
 var placeholderContainerImage = 'mcr.microsoft.com/azuredocs/containerapps-helloworld:latest'
 
-module containerRegistry 'br/public:avm/res/container-registry/registry:0.12.1' = {
-  name: take('avm.res.container-registry.registry.${solutionSuffix}', 64)
+module containerRegistry 'modules/containerRegistry.bicep' = {
+  name: take('module.container-registry.${solutionSuffix}', 64)
   params: {
-    #disable-next-line BCP334 // solutionSuffix always yields a name of sufficient length at deployment time
-    name: take('cr${solutionSuffix}', 50)
+    acrName: take('cr${solutionSuffix}', 50)
     location: location
-    acrSku: enableRedundancy ? 'Premium' : 'Standard'
-    acrAdminUserEnabled: false
-    zoneRedundancy: enableRedundancy ? 'Enabled' : 'Disabled'
+    acrSku: (enableRedundancy || enablePrivateNetworking) ? 'Premium' : 'Standard'
+    publicNetworkAccess: enablePrivateNetworking ? 'Disabled' : 'Enabled'
+    enablePrivateNetworking: enablePrivateNetworking
+    backendSubnetResourceId: enablePrivateNetworking ? virtualNetwork!.outputs.pepsSubnetResourceId : ''
+    privateDnsZoneResourceId: enablePrivateNetworking ? avmPrivateDnsZones[dnsZoneIndex.containerRegistry]!.outputs.resourceId : ''
     roleAssignments: [
       {
         principalId: appIdentity.outputs.principalId