Select the editor's cloud before deploying Bicep from Visual Studio Code

Source facts

The Bicep deployment command in Visual Studio Code uses the editor’s built-in authentication API rather than cloud profiles in bicepconfig.json. Microsoft directs custom-cloud sign-in through the Microsoft accounts extension’s Microsoft Sovereign Cloud setting. The documented deployment flow does not support multiple signed-in accounts at the same time. Microsoft Learn.

Applicability

Apply this review to deployment initiated from the editor, not to an Azure CLI command running in a terminal. Identify the intended cloud, account and subscription before choosing the deployment action. Do not treat a repository cloud profile as proof of the editor’s current sign-in destination.

DSE recommendation

DSE recommends making the editor’s authentication context an explicit pre-deployment check. Review the Microsoft accounts cloud setting, complete the intended sign-in and confirm the subscription offered by the deployment flow. Keep this separate from reviewing template parameters or the compiler version. If the displayed identity or destination differs from the approved target, stop before creating resources and resolve the context mismatch.

Verification

Use an approved nonproduction target to inspect the sign-in and subscription-selection experience. Record the selected cloud and sanitized identity information with the intended target, then verify the selected resource group before authorizing a deployment. Repeat the context check after switching clouds or accounts. Do not accept a successful local build as evidence that the editor is authenticated to the correct Azure environment.

Official references

Microsoft Learn. Source retrieved September 9, 2026.