{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "slug": "dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script", "url": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/" }, "title": "Choose the supported identity property for a Bicep deployment script", "summary": "Separate the script resource's managed-identity property from an explicit script login.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:19+00:00", "modified_at": "2026-09-17T16:42:35+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller's permissions separate from the permissions exercised by the running script.", "dse_recommendation": "DSE recommends documenting the script's target operations before selecting or granting an identity.", "primary_source": { "name": "Use deployment scripts in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. Microsoft Learn.

\n

Applicability

\n

Use this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.

\n

DSE recommendation

\n

DSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.

\n

Verification

\n

Inspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.

\n

Official references

\n

Microsoft Learn: Use deployment scripts in Bicep.

", "content_text": "Source facts\nMicrosoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. Microsoft Learn.\nApplicability\nUse this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.\nDSE recommendation\nDSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.\nVerification\nInspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.\nOfficial references\nMicrosoft Learn: Use deployment scripts in Bicep.", "content_markdown": "## Source facts\n\nMicrosoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep).\n\n## Applicability\n\nUse this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.\n\n## DSE recommendation\n\nDSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.\n\n## Verification\n\nInspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.\n\n## Official references\n\n[Microsoft Learn: Use deployment scripts in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "url": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose the supported identity property for a Bicep deployment script", "item": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "url": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/", "headline": "Choose the supported identity property for a Bicep deployment script", "description": "Separate the script resource's managed-identity property from an explicit script login.", "abstract": "Separate the script resource's managed-identity property from an explicit script login.", "articleBody": "Source facts\nMicrosoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. Microsoft Learn.\nApplicability\nUse this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.\nDSE recommendation\nDSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.\nVerification\nInspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.\nOfficial references\nMicrosoft Learn: Use deployment scripts in Bicep.", "datePublished": "2026-09-17T16:33:19+00:00", "dateModified": "2026-09-17T16:42:35+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose the supported identity property for a Bicep deployment script" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Use deployment scripts in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep" } } ] } }