# Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged

> Distinguish incomplete prediction from a clean deployment preview when expressions or modules cannot be analyzed.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:07+00:00
- Modified: 2026-09-10T00:55:35+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Distinguish incomplete prediction from a clean deployment preview when expressions or modules cannot be analyzed.

## Potentially affected

Azure Resource Manager what-if reviews of Bicep deployments.

## DSE recommendation

Require an explanation for short-circuit diagnostics and missing expected resources before accepting a deployment preview.

## Article

## Source facts

Bicep what-if can short-circuit when a resource identifier, API version, or dependency cannot be evaluated outside deployment. A module can also be excluded, leaving all of its resources out of the analysis; the API returns a diagnostic for that condition.

Microsoft says Az PowerShell 13.1.0 or later and Azure CLI 2.75.0 or later display these diagnostics. Earlier tool versions can encounter the same incomplete analysis without displaying the warning. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if).

## Applicability

Identify the tool version, submitted Bicep files, parameters, and expected resource set. Treat what-if as a prediction to inspect, not as proof that every resource was fully analyzed or that deployment is authorized.

## DSE recommendation

DSE recommends reviewing diagnostics alongside the proposed resource changes. Reconcile the expected modules and resources with the analyzed output and assign unexplained omissions to the template owner. Preserve the tool version and parameters with the result so reviewers can distinguish a template problem from a client that hides the relevant diagnostic.

## Verification

In a controlled example, compare a fully evaluable resource with one affected by an unresolved deployment expression. Confirm the chosen tool exposes the diagnostic and that the review process marks the preview incomplete. Rerun after an approved correction and verify coverage before relying on the predicted changes for a production decision.

## Official references

[Microsoft Learn: Bicep What-If: Preview Changes Before Deployment](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if). Source retrieved September 9, 2026.

## Primary reference

- Name: Bicep What-If: Preview Changes Before Deployment - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-what-if
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Inspect Bicep what-if diagnostics before treating an omitted resource as unchanged,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-169-inspect-bicep-what-if-diagnostics-before-treating-an-omitted-resource-as-unchanged/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.