diff --git a/infra/core/ai/ai-project.bicep b/infra/core/ai/ai-project.bicep
index b38126f..029c7ef 100644
--- a/infra/core/ai/ai-project.bicep
+++ b/infra/core/ai/ai-project.bicep
@@ -91,7 +91,7 @@ module applicationInsights '../monitor/applicationinsights.bicep' = if (shouldCr
     location: location
     tags: tags
     name: 'appi-${resourceToken}'
-    logAnalyticsWorkspaceId: logAnalytics.outputs.id
+    logAnalyticsWorkspaceId: logAnalytics!.outputs.id
   }
 }
 
@@ -164,15 +164,15 @@ resource appInsightConnection 'Microsoft.CognitiveServices/accounts/projects/con
   name: 'appi-connection'
   properties: {
     category: 'AppInsights'
-    target: applicationInsights.outputs.id
+    target: applicationInsights!.outputs.id
     authType: 'ApiKey'
     isSharedToAll: true
     credentials: {
-      key: applicationInsights.outputs.connectionString
+      key: applicationInsights!.outputs.connectionString
     }
     metadata: {
       ApiType: 'Azure'
-      ResourceId: applicationInsights.outputs.id
+      ResourceId: applicationInsights!.outputs.id
     }
   }
 }
@@ -370,8 +370,8 @@ output aiServicesAccountName string = aiAccount.name
 output aiServicesProjectName string = aiAccount::project.name
 output aiServicesPrincipalId string = aiAccount.identity.principalId
 output projectName string = aiAccount::project.name
-output APPLICATIONINSIGHTS_CONNECTION_STRING string = shouldCreateAppInsights ? applicationInsights.outputs.connectionString : (hasExistingAppInsightsConnectionString ? existingApplicationInsightsConnectionString : '')
-output APPLICATIONINSIGHTS_RESOURCE_ID string = shouldCreateAppInsights ? applicationInsights.outputs.id : (hasExistingAppInsightsConnectionString ? existingApplicationInsightsResourceId : '')
+output APPLICATIONINSIGHTS_CONNECTION_STRING string = shouldCreateAppInsights ? applicationInsights!.outputs.connectionString : (hasExistingAppInsightsConnectionString ? existingApplicationInsightsConnectionString : '')
+output APPLICATIONINSIGHTS_RESOURCE_ID string = shouldCreateAppInsights ? applicationInsights!.outputs.id : (hasExistingAppInsightsConnectionString ? existingApplicationInsightsResourceId : '')
 
 // Grouped dependent resources outputs
 output dependentResources object = {
diff --git a/infra/core/host/acr.bicep b/infra/core/host/acr.bicep
index 5e4acaa..34efd90 100644
--- a/infra/core/host/acr.bicep
+++ b/infra/core/host/acr.bicep
@@ -41,20 +41,21 @@ module containerRegistry 'br/public:avm/res/container-registry/registry:0.1.1' =
     location: location
     tags: tags
     publicNetworkAccess: 'Enabled'
-    roleAssignments:[
+    roleAssignments: concat([
       {
         principalId: principalId
         principalType: principalType
         roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
       }
+    ], !empty(aiServicesAccountName) && !empty(aiProjectName) ? [
       // TODO SEPARATELY
       {
         // the foundry project itself can pull from the ACR
-        principalId: aiAccount::aiProject.identity.principalId
+        principalId: aiAccount::aiProject!.identity.principalId
         principalType: 'ServicePrincipal'
         roleDefinitionIdOrName: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '7f951dda-4ed3-4680-a7ca-43fe172d538d')
       }
-    ]
+    ] : [])
   }
 }
 
@@ -70,7 +71,7 @@ module acrConnection '../ai/connection.bicep' = if (!empty(aiServicesAccountName
       target: containerRegistry.outputs.loginServer
       authType: 'ManagedIdentity'
       credentials: {
-        clientId: aiAccount::aiProject.identity.principalId
+        clientId: aiAccount::aiProject!.identity.principalId
         resourceId: containerRegistry.outputs.resourceId
       }
       isSharedToAll: true
@@ -84,4 +85,4 @@ module acrConnection '../ai/connection.bicep' = if (!empty(aiServicesAccountName
 output containerRegistryName string = containerRegistry.outputs.name
 output containerRegistryLoginServer string = containerRegistry.outputs.loginServer
 output containerRegistryResourceId string = containerRegistry.outputs.resourceId
-output containerRegistryConnectionName string = acrConnection.outputs.connectionName
+output containerRegistryConnectionName string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? acrConnection!.outputs.connectionName : ''
diff --git a/infra/core/search/bing_custom_grounding.bicep b/infra/core/search/bing_custom_grounding.bicep
index 997095f..575fa9c 100644
--- a/infra/core/search/bing_custom_grounding.bicep
+++ b/infra/core/search/bing_custom_grounding.bicep
@@ -77,6 +77,6 @@ module aiSearchConnection '../ai/connection.bicep' = if (!empty(aiServicesAccoun
 
 // Outputs
 output bingCustomGroundingName string = bingCustomSearch.name
-output bingCustomGroundingConnectionName string = aiSearchConnection.outputs.connectionName
+output bingCustomGroundingConnectionName string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? aiSearchConnection!.outputs.connectionName : ''
 output bingCustomGroundingResourceId string = bingCustomSearch.id
-output bingCustomGroundingConnectionId string = aiSearchConnection.outputs.connectionId
+output bingCustomGroundingConnectionId string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? aiSearchConnection!.outputs.connectionId : ''
diff --git a/infra/core/search/bing_grounding.bicep b/infra/core/search/bing_grounding.bicep
index 1a7b8db..99e9355 100644
--- a/infra/core/search/bing_grounding.bicep
+++ b/infra/core/search/bing_grounding.bicep
@@ -76,6 +76,6 @@ module bingSearchConnection '../ai/connection.bicep' = if (!empty(aiServicesAcco
 }
 
 output bingGroundingName string = bingSearch.name
-output bingGroundingConnectionName string = bingSearchConnection.outputs.connectionName
+output bingGroundingConnectionName string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? bingSearchConnection!.outputs.connectionName : ''
 output bingGroundingResourceId string = bingSearch.id
-output bingGroundingConnectionId string = bingSearchConnection.outputs.connectionId
+output bingGroundingConnectionId string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? bingSearchConnection!.outputs.connectionId : ''
diff --git a/infra/core/storage/storage.bicep b/infra/core/storage/storage.bicep
index 6bad1d1..f4dd3f5 100644
--- a/infra/core/storage/storage.bicep
+++ b/infra/core/storage/storage.bicep
@@ -110,4 +110,4 @@ module storageConnection '../ai/connection.bicep' = if (!empty(aiServicesAccount
 output storageAccountName string = storageAccount.name
 output storageAccountId string = storageAccount.id
 output storageAccountPrincipalId string = storageAccount.identity.principalId
-output storageConnectionName string = storageConnection.outputs.connectionName
+output storageConnectionName string = !empty(aiServicesAccountName) && !empty(aiProjectName) ? storageConnection!.outputs.connectionName : ''