{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "slug": "dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged", "url": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/" }, "title": "Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged", "summary": "Distinguish incomplete prediction from a clean deployment preview when expressions or modules cannot be analyzed.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:07+00:00", "modified_at": "2026-09-10T00:55:35+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 223, "potentially_affected": "Azure Resource Manager what-if reviews of Bicep deployments.", "dse_recommendation": "Require an explanation for short-circuit diagnostics and missing expected resources before accepting a deployment preview.", "primary_source": { "name": "Bicep What-If: Preview Changes Before Deployment - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Bicep what-if can short-circuit when a resource identifier, API version, or dependency cannot be evaluated outside deployment. A module can also be excluded, leaving all of its resources out of the analysis; the API returns a diagnostic for that condition.

\n

Microsoft says Az PowerShell 13.1.0 or later and Azure CLI 2.75.0 or later display these diagnostics. Earlier tool versions can encounter the same incomplete analysis without displaying the warning. Microsoft Learn.

\n

Applicability

\n

Identify the tool version, submitted Bicep files, parameters, and expected resource set. Treat what-if as a prediction to inspect, not as proof that every resource was fully analyzed or that deployment is authorized.

\n

DSE recommendation

\n

DSE recommends reviewing diagnostics alongside the proposed resource changes. Reconcile the expected modules and resources with the analyzed output and assign unexplained omissions to the template owner. Preserve the tool version and parameters with the result so reviewers can distinguish a template problem from a client that hides the relevant diagnostic.

\n

Verification

\n

In a controlled example, compare a fully evaluable resource with one affected by an unresolved deployment expression. Confirm the chosen tool exposes the diagnostic and that the review process marks the preview incomplete. Rerun after an approved correction and verify coverage before relying on the predicted changes for a production decision.

\n

Official references

\n

Microsoft Learn: Bicep What-If: Preview Changes Before Deployment. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBicep what-if can short-circuit when a resource identifier, API version, or dependency cannot be evaluated outside deployment. A module can also be excluded, leaving all of its resources out of the analysis; the API returns a diagnostic for that condition.\nMicrosoft says Az PowerShell 13.1.0 or later and Azure CLI 2.75.0 or later display these diagnostics. Earlier tool versions can encounter the same incomplete analysis without displaying the warning. Microsoft Learn.\nApplicability\nIdentify the tool version, submitted Bicep files, parameters, and expected resource set. Treat what-if as a prediction to inspect, not as proof that every resource was fully analyzed or that deployment is authorized.\nDSE recommendation\nDSE recommends reviewing diagnostics alongside the proposed resource changes. Reconcile the expected modules and resources with the analyzed output and assign unexplained omissions to the template owner. Preserve the tool version and parameters with the result so reviewers can distinguish a template problem from a client that hides the relevant diagnostic.\nVerification\nIn a controlled example, compare a fully evaluable resource with one affected by an unresolved deployment expression. Confirm the chosen tool exposes the diagnostic and that the review process marks the preview incomplete. Rerun after an approved correction and verify coverage before relying on the predicted changes for a production decision.\nOfficial references\nMicrosoft Learn: Bicep What-If: Preview Changes Before Deployment. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBicep what-if can short-circuit when a resource identifier, API version, or dependency cannot be evaluated outside deployment. A module can also be excluded, leaving all of its resources out of the analysis; the API returns a diagnostic for that condition.\n\nMicrosoft says Az PowerShell 13.1.0 or later and Azure CLI 2.75.0 or later display these diagnostics. Earlier tool versions can encounter the same incomplete analysis without displaying the warning. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if).\n\n## Applicability\n\nIdentify the tool version, submitted Bicep files, parameters, and expected resource set. Treat what-if as a prediction to inspect, not as proof that every resource was fully analyzed or that deployment is authorized.\n\n## DSE recommendation\n\nDSE recommends reviewing diagnostics alongside the proposed resource changes. Reconcile the expected modules and resources with the analyzed output and assign unexplained omissions to the template owner. Preserve the tool version and parameters with the result so reviewers can distinguish a template problem from a client that hides the relevant diagnostic.\n\n## Verification\n\nIn a controlled example, compare a fully evaluable resource with one affected by an unresolved deployment expression. Confirm the chosen tool exposes the diagnostic and that the review process marks the preview incomplete. Rerun after an approved correction and verify coverage before relying on the predicted changes for a production decision.\n\n## Official references\n\n[Microsoft Learn: Bicep What-If: Preview Changes Before Deployment](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "url": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged", "item": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "url": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/", "headline": "Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged", "description": "Distinguish incomplete prediction from a clean deployment preview when expressions or modules cannot be analyzed.", "abstract": "Distinguish incomplete prediction from a clean deployment preview when expressions or modules cannot be analyzed.", "articleBody": "Source facts\nBicep what-if can short-circuit when a resource identifier, API version, or dependency cannot be evaluated outside deployment. A module can also be excluded, leaving all of its resources out of the analysis; the API returns a diagnostic for that condition.\nMicrosoft says Az PowerShell 13.1.0 or later and Azure CLI 2.75.0 or later display these diagnostics. Earlier tool versions can encounter the same incomplete analysis without displaying the warning. Microsoft Learn.\nApplicability\nIdentify the tool version, submitted Bicep files, parameters, and expected resource set. Treat what-if as a prediction to inspect, not as proof that every resource was fully analyzed or that deployment is authorized.\nDSE recommendation\nDSE recommends reviewing diagnostics alongside the proposed resource changes. Reconcile the expected modules and resources with the analyzed output and assign unexplained omissions to the template owner. Preserve the tool version and parameters with the result so reviewers can distinguish a template problem from a client that hides the relevant diagnostic.\nVerification\nIn a controlled example, compare a fully evaluable resource with one affected by an unresolved deployment expression. Confirm the chosen tool exposes the diagnostic and that the review process marks the preview incomplete. Rerun after an approved correction and verify coverage before relying on the predicted changes for a production decision.\nOfficial references\nMicrosoft Learn: Bicep What-If: Preview Changes Before Deployment. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:07+00:00", "dateModified": "2026-09-10T00:55:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Bicep What-If: Preview Changes Before Deployment - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if" } } ] } }