# Make the Bicep executable explicit in an MSBuild pipeline

> The MSBuild task and platform-specific Bicep command-line package have different roles in locating the compiler.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:40+00:00
- Modified: 2026-09-10T02:01:56+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The MSBuild task and platform-specific Bicep command-line package have different roles in locating the compiler.

## Potentially affected

MSBuild projects compiling Bicep templates and parameter files into ARM JSON.

## DSE recommendation

Record the compiler source, platform and BicepPath configuration with the build definition.

## Article

## Source facts

Azure.Bicep.MSBuild provides the build task, while Azure.Bicep.CommandLine platform packages set BicepPath to the packaged executable. If the CLI is installed another way, Microsoft permits setting BicepPath through an environment variable or project PropertyGroup instead.

The BicepCompile target runs after Build by default and compiles the project’s Bicep and BicepParam items. Per-file OutputFile metadata takes precedence over the BicepOutputPath setting. Parameter-file conversion requires NuGet package version 0.23.x or later. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file).

## Applicability

Identify the actual build-agent platform, package references, item definitions and expected output artifacts. Do not substitute the compiler found on an author’s workstation for the one used in continuous integration.

## DSE recommendation

DSE recommends choosing one documented compiler-location mechanism and recording its version provenance. Review the effective BicepPath and per-file outputs when moving a build between agents. Keep generated templates and parameter files associated with the source revision that produced them. Avoid accepting an old output file merely because the overall project build succeeded.

## Verification

Run an approved build in a clean workspace and inspect the resolved compiler, target execution and newly produced JSON files. Confirm the expected template and parameter artifacts reach their configured output locations. Repeat on each supported agent platform before standardizing the pipeline. Preserve version and artifact evidence without presenting compilation success as proof that a deployment was performed.

## Official references

[Microsoft Learn: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file). Source retrieved September 9, 2026.

## Primary reference

- Name: Quickstart: Use MSBuild tasks to convert Bicep files and parameters to JSON - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/msbuild-bicep-file
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Make the Bicep executable explicit in an MSBuild pipeline,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-376-make-the-bicep-executable-explicit-in-an-msbuild-pipeline/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.