# Separate permitted Bicep array values from the number of required selections

> Review membership and item-count requirements separately before accepting a deployment input.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:27+00:00
- Modified: 2026-09-10T02:04:58+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Review membership and item-count requirements separately before accepting a deployment input.

## Potentially affected

Bicep templates with array deployment parameters.

## DSE recommendation

DSE recommends reviewing the parameter declaration alongside the caller's intended selection.

## Article

## Source facts

Bicep allows an array parameter to contain a subset of its permitted values; the allowed-values list is not a requirement to supply the entire list. The minLength and maxLength constraints address array item counts. For a string, those constraints instead measure characters. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters).

## Applicability

Use this distinction when a module receives a selection list. Write down whether the business requirement concerns permitted choices, a minimum number of choices, or an explicitly required combination. Do not label those different requirements simply as input validation.

## DSE recommendation

DSE recommends reviewing the parameter declaration alongside the caller’s intended selection. Express the required item-count bounds separately from permitted membership, and document any combination requirement that still needs its own validation design. Avoid expanding the allowed set merely to make a failing deployment pass; resolve whether the rejected value or the contract is wrong first.

## Verification

Prepare controlled cases containing an allowed subset, an unapproved entry, and inputs on either side of the intended count boundary. Compare each result with the written requirement before approving the module revision. Retain the parameter declaration and synthetic test inputs together. Include a case with fewer selections than the complete allowed list so the test does not accidentally assume that every choice must always be present.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters). Source retrieved September 9, 2026.

## Primary reference

- Name: Parameters in Bicep files - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/parameters
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate permitted Bicep array values from the number of required selections,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-449-separate-permitted-bicep-array-values-from-the-number-of-required-selections/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.