# Select the editor's cloud before deploying Bicep from Visual Studio Code

> Does a bicepconfig.json cloud profile select the cloud used by the editor's deployment command?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-245-select-the-editor-s-cloud-before-deploying-bicep-from-visual-studio-code/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:51+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Does a bicepconfig.json cloud profile select the cloud used by the editor's deployment command?

## Potentially affected

Visual Studio Code deployments using the Bicep extension's Deploy Bicep File command.

## DSE recommendation

DSE recommends making the editor's authentication context an explicit pre-deployment check.

## Article

## Source facts

The Bicep deployment command in Visual Studio Code uses the editor’s built-in authentication API rather than cloud profiles in bicepconfig.json. Microsoft directs custom-cloud sign-in through the Microsoft accounts extension’s Microsoft Sovereign Cloud setting. The documented deployment flow does not support multiple signed-in accounts at the same time. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/visual-studio-code).

## Applicability

Apply this review to deployment initiated from the editor, not to an Azure CLI command running in a terminal. Identify the intended cloud, account and subscription before choosing the deployment action. Do not treat a repository cloud profile as proof of the editor’s current sign-in destination.

## DSE recommendation

DSE recommends making the editor’s authentication context an explicit pre-deployment check. Review the Microsoft accounts cloud setting, complete the intended sign-in and confirm the subscription offered by the deployment flow. Keep this separate from reviewing template parameters or the compiler version. If the displayed identity or destination differs from the approved target, stop before creating resources and resolve the context mismatch.

## Verification

Use an approved nonproduction target to inspect the sign-in and subscription-selection experience. Record the selected cloud and sanitized identity information with the intended target, then verify the selected resource group before authorizing a deployment. Repeat the context check after switching clouds or accounts. Do not accept a successful local build as evidence that the editor is authenticated to the correct Azure environment.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/visual-studio-code). Source retrieved September 9, 2026.

## Primary reference

- Name: Create Bicep files with Visual Studio Code - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/visual-studio-code
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Select the editor's cloud before deploying Bicep from Visual Studio Code,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-245-select-the-editor-s-cloud-before-deploying-bicep-from-visual-studio-code/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.