{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "slug": "dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments", "url": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/" }, "title": "Separate cross-subscription Bicep references from deployments", "summary": "Does an existing resource reference establish the scope needed to deploy another subscription's resources?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:22+00:00", "modified_at": "2026-09-10T02:14:31+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 239, "potentially_affected": "Bicep subscription deployments referencing or deploying into another subscription.", "dse_recommendation": "DSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner.", "primary_source": { "name": "Use Bicep to deploy resources to subscription - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Bicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. Microsoft Learn.

\n

Applicability

\n

Use this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.

\n

DSE recommendation

\n

DSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.

\n

Verification

\n

Validate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nBicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. Microsoft Learn.\nApplicability\nUse this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.\nDSE recommendation\nDSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.\nVerification\nValidate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nBicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription).\n\n## Applicability\n\nUse this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.\n\n## DSE recommendation\n\nDSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.\n\n## Verification\n\nValidate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "url": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Separate cross-subscription Bicep references from deployments", "item": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "url": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/", "headline": "Separate cross-subscription Bicep references from deployments", "description": "Does an existing resource reference establish the scope needed to deploy another subscription's resources?", "abstract": "Does an existing resource reference establish the scope needed to deploy another subscription's resources?", "articleBody": "Source facts\nBicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. Microsoft Learn.\nApplicability\nUse this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.\nDSE recommendation\nDSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.\nVerification\nValidate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:22:22+00:00", "dateModified": "2026-09-10T02:14:31+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Separate cross-subscription Bicep references from deployments" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use Bicep to deploy resources to subscription - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription" } } ] } }