I've created a custom policy as an improvement since it uses ARM template functions to determine the domain suffix in the defaultHostname property of the App Service App, and then determines which of the two private dns zones to use (given by the input parameters).
The builtin policy Configure App Service apps to use private DNS zones does not evaluate the domain suffix used by the App Service app (azurewebsites.net versus appserviceenvironment.net).
I've created a custom policy as an improvement since it uses ARM template functions to determine the domain suffix in the defaultHostname property of the App Service App, and then determines which of the two private dns zones to use (given by the input parameters).