Issue with existing DNS zones

This template is designed with the assumption that private DNS zones reside within the same subscription as the deployment. As a result, it only prompts for the resource group name, under the expectation that the DNS zones are co-located with other resources.
However, in real-world enterprise environments—particularly those adhering to the Microsoft Cloud Adoption Framework (CAF)—DNS infrastructure is typically centralized and managed within a dedicated Identity or Connectivity subscription. This separation aligns with best practices for network and identity isolation, governance, and lifecycle management.
If DNS zones are provisioned in a different subscription - this template would fail.

@description('Map of DNS zone FQDNs to resource group names. If provided, reference existing DNS zones in this resource group instead of creating them.')

Start with samples/microsoft/infrastructure-setup/15-private-network-standard-agent-setup/modules-network-secured/private-endpoint-and-dns.bicep around line 65, where existing DNS zones are configured. Trace how the template resolves the resource group and subscription, then verify the template also works when the DNS zone is in a separate subscription.