WVD ARM Template Customization Requires Public Storage Bucket

As per - https://github.com/Azure/RDS-Templates/tree/master/wvd-sh/arm-template-customization

> This solution will deploy the Virtual Desktop Optimization Tool to an AVD session host using the Azure Portal with the Custom Configuration option. The json and ps1 files must be saved to a publicly accessible storage location, like a public GitHub repository or a public Azure Blob Storage container.

The deployment of critical organisational configuration settings, scripts, and other sensitive data to public storage goes against industry best practices and basic security hygiene. This practice exposes an organisation's infrastructure to potential unwanted access, and exploitation by malicious actors. By making these files publicly available, attackers can easily identify and target vulnerabilities, potentially leading to compromised systems, data theft, and repetitional damage.

Moreover, the use of public storage for sensitive information violates the principle of least privilege, which dictates that access to resources should be granted only when necessary and with the minimum permissions required. Storing configuration files and scripts in public repositories grants unrestricted access to anyone, regardless of their authorisation level or intentions.

Who specifically thought this was acceptable for an enterprise deployment?

Review the wvd-sh/arm-template-customization path and the Azure Portal Custom Configuration flow, focusing on how the referenced JSON and PS1 files are retrieved. Determine whether a private storage or authorised-access path is supported and define the deployment and access checks required for completion. Done should mean the customization no longer requires public storage for organisational configuration and scripts.

Written by the indexing model from the issue text.