Separate cross-subscription Bicep references from deployments

Source facts

Bicep permits references to existing resources outside the deployment’s scope. To deploy resources into another subscription, Microsoft’s subscription-deployment guidance uses a module whose scope identifies that subscription. A module starts a nested deployment, and the principal running the parent must have the necessary deployment permissions at the targeted scopes. Microsoft Learn.

Applicability

Use this distinction when a template already reads or references a shared resource and is being extended to create resources elsewhere. Identify which declarations describe existing resources and which initiate deployments. Do not treat a successful reference as evidence that a later cross-subscription deployment is correctly scoped or authorized.

DSE recommendation

DSE recommends documenting the target subscription for each deploying module and reviewing that target with the identity owner. Keep the intended scope explicit in the module inputs and invocation record. Assess the actual deployment principal’s permissions for the requested operations rather than borrowing assumptions from an author’s interactive account. Preserve existing-resource references where the design only needs to consume them.

Verification

Validate the compiled deployment structure in an approved scope and confirm that the nested deployment targets the intended subscription. Test the reference path and the deployment path separately using harmless resources and the intended identity. Check the resulting resource identifiers and authorization outcome before expanding the change. Record which operation succeeded; do not combine a read result and a create result into one undifferentiated success statement.

Official references

Microsoft Learn. Source retrieved September 9, 2026.