{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "slug": "dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation", "url": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/" }, "title": "Seal Bicep input objects when extra properties must fail validation", "summary": "An object type alone can leave likely property-name mistakes as warnings; sealing makes the contract stricter.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:17+00:00", "modified_at": "2026-09-10T01:23:49+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 232, "potentially_affected": "Bicep templates using user-defined object types for deployment parameters.", "dse_recommendation": "Use sealed object contracts where unrecognized input must be rejected, and test both compiler and deployment validation.", "primary_source": { "name": "User-defined types in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/user-defined-data-types", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Bicep user-defined types require CLI version 0.12.X or later and enable language-version 2.0 code generation. By default, an object type accepts additional properties; a likely misspelling can produce BCP089 as a warning rather than an error.

\n

Applying @sealed() to the object type or parameter elevates that warning to an error. Azure Resource Manager also validates sealed parameters and fails deployment validation when they contain extra properties. Microsoft Learn.

\n

Applicability

\n

Identify the pipeline’s Bicep version and which input objects have a deliberately closed schema. Do not apply a closed contract to an extension field that callers are intentionally allowed to populate freely.

\n

DSE recommendation

\n

DSE recommends reviewing accepted property names with the module’s callers before sealing an input. Make the desired treatment of unknown fields explicit in the contract. Include a misspelled optional property and a genuinely additional property in the validation cases. Plan the change with existing callers rather than assuming every previously accepted input remains compatible.

\n

Verification

\n

Run the current pipeline against valid input and the two invalid cases in a controlled scope. Retain compiler diagnostics and parameter-validation outcomes separately. Confirm that the expected valid properties still work and that an unrecognized field is not silently treated as an approved setting. Record the tested tool version with the contract change so later pipeline upgrades can repeat the same checks.

\n

Official references

\n

Microsoft Learn: User-defined types in Bicep. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBicep user-defined types require CLI version 0.12.X or later and enable language-version 2.0 code generation. By default, an object type accepts additional properties; a likely misspelling can produce BCP089 as a warning rather than an error.\nApplying @sealed() to the object type or parameter elevates that warning to an error. Azure Resource Manager also validates sealed parameters and fails deployment validation when they contain extra properties. Microsoft Learn.\nApplicability\nIdentify the pipeline’s Bicep version and which input objects have a deliberately closed schema. Do not apply a closed contract to an extension field that callers are intentionally allowed to populate freely.\nDSE recommendation\nDSE recommends reviewing accepted property names with the module’s callers before sealing an input. Make the desired treatment of unknown fields explicit in the contract. Include a misspelled optional property and a genuinely additional property in the validation cases. Plan the change with existing callers rather than assuming every previously accepted input remains compatible.\nVerification\nRun the current pipeline against valid input and the two invalid cases in a controlled scope. Retain compiler diagnostics and parameter-validation outcomes separately. Confirm that the expected valid properties still work and that an unrecognized field is not silently treated as an approved setting. Record the tested tool version with the contract change so later pipeline upgrades can repeat the same checks.\nOfficial references\nMicrosoft Learn: User-defined types in Bicep. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBicep user-defined types require CLI version 0.12.X or later and enable language-version 2.0 code generation. By default, an object type accepts additional properties; a likely misspelling can produce BCP089 as a warning rather than an error.\n\nApplying @sealed() to the object type or parameter elevates that warning to an error. Azure Resource Manager also validates sealed parameters and fails deployment validation when they contain extra properties. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/user-defined-data-types).\n\n## Applicability\n\nIdentify the pipeline’s Bicep version and which input objects have a deliberately closed schema. Do not apply a closed contract to an extension field that callers are intentionally allowed to populate freely.\n\n## DSE recommendation\n\nDSE recommends reviewing accepted property names with the module’s callers before sealing an input. Make the desired treatment of unknown fields explicit in the contract. Include a misspelled optional property and a genuinely additional property in the validation cases. Plan the change with existing callers rather than assuming every previously accepted input remains compatible.\n\n## Verification\n\nRun the current pipeline against valid input and the two invalid cases in a controlled scope. Retain compiler diagnostics and parameter-validation outcomes separately. Confirm that the expected valid properties still work and that an unrecognized field is not silently treated as an approved setting. Record the tested tool version with the contract change so later pipeline upgrades can repeat the same checks.\n\n## Official references\n\n[Microsoft Learn: User-defined types in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/user-defined-data-types). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Seal Bicep input objects when extra properties must fail validation", "item": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "url": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/", "headline": "Seal Bicep input objects when extra properties must fail validation", "description": "An object type alone can leave likely property-name mistakes as warnings; sealing makes the contract stricter.", "abstract": "An object type alone can leave likely property-name mistakes as warnings; sealing makes the contract stricter.", "articleBody": "Source facts\nBicep user-defined types require CLI version 0.12.X or later and enable language-version 2.0 code generation. By default, an object type accepts additional properties; a likely misspelling can produce BCP089 as a warning rather than an error.\nApplying @sealed() to the object type or parameter elevates that warning to an error. Azure Resource Manager also validates sealed parameters and fails deployment validation when they contain extra properties. Microsoft Learn.\nApplicability\nIdentify the pipeline’s Bicep version and which input objects have a deliberately closed schema. Do not apply a closed contract to an extension field that callers are intentionally allowed to populate freely.\nDSE recommendation\nDSE recommends reviewing accepted property names with the module’s callers before sealing an input. Make the desired treatment of unknown fields explicit in the contract. Include a misspelled optional property and a genuinely additional property in the validation cases. Plan the change with existing callers rather than assuming every previously accepted input remains compatible.\nVerification\nRun the current pipeline against valid input and the two invalid cases in a controlled scope. Retain compiler diagnostics and parameter-validation outcomes separately. Confirm that the expected valid properties still work and that an unrecognized field is not silently treated as an approved setting. Record the tested tool version with the contract change so later pipeline upgrades can repeat the same checks.\nOfficial references\nMicrosoft Learn: User-defined types in Bicep. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:17+00:00", "dateModified": "2026-09-10T01:23:49+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-279-seal-bicep-input-objects-when-extra-properties-must-fail-validation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Seal Bicep input objects when extra properties must fail validation" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 232, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "User-defined types in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/user-defined-data-types" } } ] } }