{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "slug": "dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts", "url": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/" }, "title": "Install Bicep separately for PowerShell deployment hosts", "summary": "The Bicep copy managed by Azure CLI is not the PowerShell compiler installation.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:32:48+00:00", "modified_at": "2026-09-17T16:42:36+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 207, "potentially_affected": "Use this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.", "dse_recommendation": "DSE recommends documenting which deployment tool owns each Bicep installation on the host.", "primary_source": { "name": "Install Bicep tools - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft states that the self-contained Bicep CLI installed by Azure CLI is not available to PowerShell commands. Azure PowerShell deployments require a separate manual Bicep installation. The guide also distinguishes the standalone bicep command from Azure CLI’s az bicep command form. Microsoft Learn.

\n

Applicability

\n

Use this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.

\n

DSE recommendation

\n

DSE recommends documenting which deployment tool owns each Bicep installation on the host. Follow the current manual-installation guidance for the platform and verify the standalone executable under the job’s identity. Record its version with the deployment toolchain. Avoid changing a shared path without checking other jobs that depend on it.

\n

Verification

\n

Under the intended execution account, identify and run the standalone Bicep version check, then compile an approved small file. Execute a permitted PowerShell validation or isolated deployment using that environment. Retain the executable location, version and result. Recheck after toolchain updates so the job’s working compiler is not inferred from an unrelated Azure CLI test.

\n

Official references

\n

Microsoft Learn: Install Bicep tools.

", "content_text": "Source facts\nMicrosoft states that the self-contained Bicep CLI installed by Azure CLI is not available to PowerShell commands. Azure PowerShell deployments require a separate manual Bicep installation. The guide also distinguishes the standalone bicep command from Azure CLI’s az bicep command form. Microsoft Learn.\nApplicability\nUse this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.\nDSE recommendation\nDSE recommends documenting which deployment tool owns each Bicep installation on the host. Follow the current manual-installation guidance for the platform and verify the standalone executable under the job’s identity. Record its version with the deployment toolchain. Avoid changing a shared path without checking other jobs that depend on it.\nVerification\nUnder the intended execution account, identify and run the standalone Bicep version check, then compile an approved small file. Execute a permitted PowerShell validation or isolated deployment using that environment. Retain the executable location, version and result. Recheck after toolchain updates so the job’s working compiler is not inferred from an unrelated Azure CLI test.\nOfficial references\nMicrosoft Learn: Install Bicep tools.", "content_markdown": "## Source facts\n\nMicrosoft states that the self-contained Bicep CLI installed by Azure CLI is not available to PowerShell commands. Azure PowerShell deployments require a separate manual Bicep installation. The guide also distinguishes the standalone bicep command from Azure CLI’s az bicep command form. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install).\n\n## Applicability\n\nUse this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.\n\n## DSE recommendation\n\nDSE recommends documenting which deployment tool owns each Bicep installation on the host. Follow the current manual-installation guidance for the platform and verify the standalone executable under the job’s identity. Record its version with the deployment toolchain. Avoid changing a shared path without checking other jobs that depend on it.\n\n## Verification\n\nUnder the intended execution account, identify and run the standalone Bicep version check, then compile an approved small file. Execute a permitted PowerShell validation or isolated deployment using that environment. Retain the executable location, version and result. Recheck after toolchain updates so the job’s working compiler is not inferred from an unrelated Azure CLI test.\n\n## Official references\n\n[Microsoft Learn: Install Bicep tools](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "url": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Install Bicep separately for PowerShell deployment hosts", "item": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "url": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/", "headline": "Install Bicep separately for PowerShell deployment hosts", "description": "The Bicep copy managed by Azure CLI is not the PowerShell compiler installation.", "abstract": "The Bicep copy managed by Azure CLI is not the PowerShell compiler installation.", "articleBody": "Source facts\nMicrosoft states that the self-contained Bicep CLI installed by Azure CLI is not available to PowerShell commands. Azure PowerShell deployments require a separate manual Bicep installation. The guide also distinguishes the standalone bicep command from Azure CLI’s az bicep command form. Microsoft Learn.\nApplicability\nUse this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.\nDSE recommendation\nDSE recommends documenting which deployment tool owns each Bicep installation on the host. Follow the current manual-installation guidance for the platform and verify the standalone executable under the job’s identity. Record its version with the deployment toolchain. Avoid changing a shared path without checking other jobs that depend on it.\nVerification\nUnder the intended execution account, identify and run the standalone Bicep version check, then compile an approved small file. Execute a permitted PowerShell validation or isolated deployment using that environment. Retain the executable location, version and result. Recheck after toolchain updates so the job’s working compiler is not inferred from an unrelated Azure CLI test.\nOfficial references\nMicrosoft Learn: Install Bicep tools.", "datePublished": "2026-09-17T16:32:48+00:00", "dateModified": "2026-09-17T16:42:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Install Bicep separately for PowerShell deployment hosts" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 207, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Install Bicep tools - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install" } } ] } }