# Separate cross-subscription Bicep references from deployments

> Does an existing resource reference establish the scope needed to deploy another subscription's resources?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:22+00:00
- Modified: 2026-09-10T02:14:31+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Does an existing resource reference establish the scope needed to deploy another subscription's resources?

## Potentially affected

Bicep subscription deployments referencing or deploying into another subscription.

## DSE recommendation

DSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner.

## Article

## Source facts

Bicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription).

## Applicability

Use this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.

## DSE recommendation

DSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.

## Verification

Validate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription). Source retrieved September 9, 2026.

## Primary reference

- Name: Use Bicep to deploy resources to subscription - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deploy-to-subscription
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Separate cross-subscription Bicep references from deployments,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-574-separate-cross-subscription-bicep-references-from-deployments/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.