{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "slug": "dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections", "url": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/" }, "title": "Separate permitted Bicep array values from the number of required selections", "summary": "Review membership and item-count requirements separately before accepting a deployment input.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:27+00:00", "modified_at": "2026-09-10T02:04:58+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 217, "potentially_affected": "Bicep templates with array deployment parameters.", "dse_recommendation": "DSE recommends reviewing the parameter declaration alongside the caller's intended selection.", "primary_source": { "name": "Parameters in Bicep files - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Bicep allows an array parameter to contain a subset of its permitted values; the allowed-values list is not a requirement to supply the entire list. The minLength and maxLength constraints address array item counts. For a string, those constraints instead measure characters. Microsoft Learn.

\n

Applicability

\n

Use this distinction when a module receives a selection list. Write down whether the business requirement concerns permitted choices, a minimum number of choices, or an explicitly required combination. Do not label those different requirements simply as input validation.

\n

DSE recommendation

\n

DSE recommends reviewing the parameter declaration alongside the caller’s intended selection. Express the required item-count bounds separately from permitted membership, and document any combination requirement that still needs its own validation design. Avoid expanding the allowed set merely to make a failing deployment pass; resolve whether the rejected value or the contract is wrong first.

\n

Verification

\n

Prepare controlled cases containing an allowed subset, an unapproved entry, and inputs on either side of the intended count boundary. Compare each result with the written requirement before approving the module revision. Retain the parameter declaration and synthetic test inputs together. Include a case with fewer selections than the complete allowed list so the test does not accidentally assume that every choice must always be present.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBicep allows an array parameter to contain a subset of its permitted values; the allowed-values list is not a requirement to supply the entire list. The minLength and maxLength constraints address array item counts. For a string, those constraints instead measure characters. Microsoft Learn.\nApplicability\nUse this distinction when a module receives a selection list. Write down whether the business requirement concerns permitted choices, a minimum number of choices, or an explicitly required combination. Do not label those different requirements simply as input validation.\nDSE recommendation\nDSE recommends reviewing the parameter declaration alongside the caller’s intended selection. Express the required item-count bounds separately from permitted membership, and document any combination requirement that still needs its own validation design. Avoid expanding the allowed set merely to make a failing deployment pass; resolve whether the rejected value or the contract is wrong first.\nVerification\nPrepare controlled cases containing an allowed subset, an unapproved entry, and inputs on either side of the intended count boundary. Compare each result with the written requirement before approving the module revision. Retain the parameter declaration and synthetic test inputs together. Include a case with fewer selections than the complete allowed list so the test does not accidentally assume that every choice must always be present.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBicep allows an array parameter to contain a subset of its permitted values; the allowed-values list is not a requirement to supply the entire list. The minLength and maxLength constraints address array item counts. For a string, those constraints instead measure characters. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters).\n\n## Applicability\n\nUse this distinction when a module receives a selection list. Write down whether the business requirement concerns permitted choices, a minimum number of choices, or an explicitly required combination. Do not label those different requirements simply as input validation.\n\n## DSE recommendation\n\nDSE recommends reviewing the parameter declaration alongside the caller’s intended selection. Express the required item-count bounds separately from permitted membership, and document any combination requirement that still needs its own validation design. Avoid expanding the allowed set merely to make a failing deployment pass; resolve whether the rejected value or the contract is wrong first.\n\n## Verification\n\nPrepare controlled cases containing an allowed subset, an unapproved entry, and inputs on either side of the intended count boundary. Compare each result with the written requirement before approving the module revision. Retain the parameter declaration and synthetic test inputs together. Include a case with fewer selections than the complete allowed list so the test does not accidentally assume that every choice must always be present.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "url": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate permitted Bicep array values from the number of required selections", "item": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "url": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/", "headline": "Separate permitted Bicep array values from the number of required selections", "description": "Review membership and item-count requirements separately before accepting a deployment input.", "abstract": "Review membership and item-count requirements separately before accepting a deployment input.", "articleBody": "Source facts\nBicep allows an array parameter to contain a subset of its permitted values; the allowed-values list is not a requirement to supply the entire list. The minLength and maxLength constraints address array item counts. For a string, those constraints instead measure characters. Microsoft Learn.\nApplicability\nUse this distinction when a module receives a selection list. Write down whether the business requirement concerns permitted choices, a minimum number of choices, or an explicitly required combination. Do not label those different requirements simply as input validation.\nDSE recommendation\nDSE recommends reviewing the parameter declaration alongside the caller’s intended selection. Express the required item-count bounds separately from permitted membership, and document any combination requirement that still needs its own validation design. Avoid expanding the allowed set merely to make a failing deployment pass; resolve whether the rejected value or the contract is wrong first.\nVerification\nPrepare controlled cases containing an allowed subset, an unapproved entry, and inputs on either side of the intended count boundary. Compare each result with the written requirement before approving the module revision. Retain the parameter declaration and synthetic test inputs together. Include a case with fewer selections than the complete allowed list so the test does not accidentally assume that every choice must always be present.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:24:27+00:00", "dateModified": "2026-09-10T02:04:58+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate permitted Bicep array values from the number of required selections" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 217, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Parameters in Bicep files - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters" } } ] } }