# Install Bicep separately for PowerShell deployment hosts

> The Bicep copy managed by Azure CLI is not the PowerShell compiler installation.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:32:48+00:00
- Modified: 2026-09-17T16:42:36+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

The Bicep copy managed by Azure CLI is not the PowerShell compiler installation.

## Potentially affected

Use this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.

## DSE recommendation

DSE recommends documenting which deployment tool owns each Bicep installation on the host.

## Article

## Source facts

Microsoft states that the self-contained Bicep CLI installed by Azure CLI is not available to PowerShell commands. Azure PowerShell deployments require a separate manual Bicep installation. The guide also distinguishes the standalone bicep command from Azure CLI’s az bicep command form. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install).

## Applicability

Use this review when preparing a workstation or automation host that will deploy Bicep through Azure PowerShell. Identify the actual execution account and environment. A successful check performed in a different shell or user session does not establish that the deployment job can locate its compiler.

## DSE recommendation

DSE recommends documenting which deployment tool owns each Bicep installation on the host. Follow the current manual-installation guidance for the platform and verify the standalone executable under the job’s identity. Record its version with the deployment toolchain. Avoid changing a shared path without checking other jobs that depend on it.

## Verification

Under the intended execution account, identify and run the standalone Bicep version check, then compile an approved small file. Execute a permitted PowerShell validation or isolated deployment using that environment. Retain the executable location, version and result. Recheck after toolchain updates so the job’s working compiler is not inferred from an unrelated Azure CLI test.

## Official references

[Microsoft Learn: Install Bicep tools](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install).

## Primary reference

- Name: Install Bicep tools - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/install
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Install Bicep separately for PowerShell deployment hosts,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-132-install-bicep-separately-for-powershell-deployment-hosts/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.