# Choose the supported identity property for a Bicep deployment script

> Separate the script resource's managed-identity property from an explicit script login.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:19+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Separate the script resource's managed-identity property from an explicit script login.

## Potentially affected

Use this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller's permissions separate from the permissions exercised by the running script.

## DSE recommendation

DSE recommends documenting the script's target operations before selecting or granting an identity.

## Article

## Source facts

Microsoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep).

## Applicability

Use this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.

## DSE recommendation

DSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.

## Verification

Inspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.

## Official references

[Microsoft Learn: Use deployment scripts in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep).

## Primary reference

- Name: Use deployment scripts in Bicep - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-bicep
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose the supported identity property for a Bicep deployment script,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-101-choose-the-supported-identity-property-for-a-bicep-deployment-script/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.