Choose the supported identity property for a Bicep deployment script

Source facts

Microsoft states that a Bicep deployment script resource’s identity property currently supports a user-assigned managed identity. When supplied, the script service signs in with that identity before invoking the script. The identity must hold the access required for the script’s own operations. Microsoft Learn.

Applicability

Use this review for a script resource that is intended to authenticate through its identity property. Identify the exact operations inside the script and the user-assigned identity planned for them. Keep the deployment caller’s permissions separate from the permissions exercised by the running script.

DSE recommendation

DSE recommends documenting the script’s target operations before selecting or granting an identity. Have the target-resource owner review the narrow access needed for those operations. Confirm that the template references the intended identity and that the script is not silently switching to another account. Use an isolated deployment for the first authorization test.

Verification

Inspect the deployed identity reference and run a harmless approved operation against the intended target. Confirm that the result is attributable to the expected script identity and that an out-of-scope operation remains denied. Retain sanitized identity and target identifiers with the script version. Investigate differences before granting broader roles merely to complete the deployment.

Official references

Microsoft Learn: Use deployment scripts in Bicep.