{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "slug": "dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline", "url": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/" }, "title": "Make the Bicep executable explicit in an MSBuild pipeline", "summary": "The MSBuild task and platform-specific Bicep command-line package have different roles in locating the compiler.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:25:40+00:00", "modified_at": "2026-09-10T02:01:56+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 239, "potentially_affected": "MSBuild projects compiling Bicep templates and parameter files into ARM JSON.", "dse_recommendation": "Record the compiler source, platform and BicepPath configuration with the build definition.", "primary_source": { "name": "Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure.Bicep.MSBuild provides the build task, while Azure.Bicep.CommandLine platform packages set BicepPath to the packaged executable. If the CLI is installed another way, Microsoft permits setting BicepPath through an environment variable or project PropertyGroup instead.

\n

The BicepCompile target runs after Build by default and compiles the project’s Bicep and BicepParam items. Per-file OutputFile metadata takes precedence over the BicepOutputPath setting. Parameter-file conversion requires NuGet package version 0.23.x or later. Microsoft Learn.

\n

Applicability

\n

Identify the actual build-agent platform, package references, item definitions and expected output artifacts. Do not substitute the compiler found on an author’s workstation for the one used in continuous integration.

\n

DSE recommendation

\n

DSE recommends choosing one documented compiler-location mechanism and recording its version provenance. Review the effective BicepPath and per-file outputs when moving a build between agents. Keep generated templates and parameter files associated with the source revision that produced them. Avoid accepting an old output file merely because the overall project build succeeded.

\n

Verification

\n

Run an approved build in a clean workspace and inspect the resolved compiler, target execution and newly produced JSON files. Confirm the expected template and parameter artifacts reach their configured output locations. Repeat on each supported agent platform before standardizing the pipeline. Preserve version and artifact evidence without presenting compilation success as proof that a deployment was performed.

\n

Official references

\n

Microsoft Learn: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON. Source retrieved September 9, 2026.

", "content_text": "Source facts\nAzure.Bicep.MSBuild provides the build task, while Azure.Bicep.CommandLine platform packages set BicepPath to the packaged executable. If the CLI is installed another way, Microsoft permits setting BicepPath through an environment variable or project PropertyGroup instead.\nThe BicepCompile target runs after Build by default and compiles the project’s Bicep and BicepParam items. Per-file OutputFile metadata takes precedence over the BicepOutputPath setting. Parameter-file conversion requires NuGet package version 0.23.x or later. Microsoft Learn.\nApplicability\nIdentify the actual build-agent platform, package references, item definitions and expected output artifacts. Do not substitute the compiler found on an author’s workstation for the one used in continuous integration.\nDSE recommendation\nDSE recommends choosing one documented compiler-location mechanism and recording its version provenance. Review the effective BicepPath and per-file outputs when moving a build between agents. Keep generated templates and parameter files associated with the source revision that produced them. Avoid accepting an old output file merely because the overall project build succeeded.\nVerification\nRun an approved build in a clean workspace and inspect the resolved compiler, target execution and newly produced JSON files. Confirm the expected template and parameter artifacts reach their configured output locations. Repeat on each supported agent platform before standardizing the pipeline. Preserve version and artifact evidence without presenting compilation success as proof that a deployment was performed.\nOfficial references\nMicrosoft Learn: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nAzure.Bicep.MSBuild provides the build task, while Azure.Bicep.CommandLine platform packages set BicepPath to the packaged executable. If the CLI is installed another way, Microsoft permits setting BicepPath through an environment variable or project PropertyGroup instead.\n\nThe BicepCompile target runs after Build by default and compiles the project’s Bicep and BicepParam items. Per-file OutputFile metadata takes precedence over the BicepOutputPath setting. Parameter-file conversion requires NuGet package version 0.23.x or later. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file).\n\n## Applicability\n\nIdentify the actual build-agent platform, package references, item definitions and expected output artifacts. Do not substitute the compiler found on an author’s workstation for the one used in continuous integration.\n\n## DSE recommendation\n\nDSE recommends choosing one documented compiler-location mechanism and recording its version provenance. Review the effective BicepPath and per-file outputs when moving a build between agents. Keep generated templates and parameter files associated with the source revision that produced them. Avoid accepting an old output file merely because the overall project build succeeded.\n\n## Verification\n\nRun an approved build in a clean workspace and inspect the resolved compiler, target execution and newly produced JSON files. Confirm the expected template and parameter artifacts reach their configured output locations. Repeat on each supported agent platform before standardizing the pipeline. Preserve version and artifact evidence without presenting compilation success as proof that a deployment was performed.\n\n## Official references\n\n[Microsoft Learn: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "url": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Make the Bicep executable explicit in an MSBuild pipeline", "item": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "url": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/", "headline": "Make the Bicep executable explicit in an MSBuild pipeline", "description": "The MSBuild task and platform-specific Bicep command-line package have different roles in locating the compiler.", "abstract": "The MSBuild task and platform-specific Bicep command-line package have different roles in locating the compiler.", "articleBody": "Source facts\nAzure.Bicep.MSBuild provides the build task, while Azure.Bicep.CommandLine platform packages set BicepPath to the packaged executable. If the CLI is installed another way, Microsoft permits setting BicepPath through an environment variable or project PropertyGroup instead.\nThe BicepCompile target runs after Build by default and compiles the project’s Bicep and BicepParam items. Per-file OutputFile metadata takes precedence over the BicepOutputPath setting. Parameter-file conversion requires NuGet package version 0.23.x or later. Microsoft Learn.\nApplicability\nIdentify the actual build-agent platform, package references, item definitions and expected output artifacts. Do not substitute the compiler found on an author’s workstation for the one used in continuous integration.\nDSE recommendation\nDSE recommends choosing one documented compiler-location mechanism and recording its version provenance. Review the effective BicepPath and per-file outputs when moving a build between agents. Keep generated templates and parameter files associated with the source revision that produced them. Avoid accepting an old output file merely because the overall project build succeeded.\nVerification\nRun an approved build in a clean workspace and inspect the resolved compiler, target execution and newly produced JSON files. Confirm the expected template and parameter artifacts reach their configured output locations. Repeat on each supported agent platform before standardizing the pipeline. Preserve version and artifact evidence without presenting compilation success as proof that a deployment was performed.\nOfficial references\nMicrosoft Learn: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:25:40+00:00", "dateModified": "2026-09-10T02:01:56+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Make the Bicep executable explicit in an MSBuild pipeline" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file" } } ] } }