top of page
Search

Deploying Bicep Files Part 7 - Azure DevOps Pipelines - BicepDeploy Task

Writer: Nathan
Nathan
2 hours ago
5 min read

If you haven't already, please check out the previous parts of this series.




Deploying Bicep with Azure DevOps Pipelines using the BicepDeploy Task


Azure DevOps Pipelines finally has its own native task for deploying Bicep files. This task was released in March 2026 and now represents the best way to natively deploy Bicep files using Azure DevOps Pipelines.


Note: In part 4 of this series I also discuss Azure DevOps Pipelines. However, that older post focuses on the ARMTemplateDeployment task, which I can't really recommend now that we have this new task. BicepDeploy has multiple advantages over ARMTemplateDeployment. Three big ones include:


  • BicepDeploy supports the "what-if" option

  • BicepDeploy supports all deployment scopes, including the Tenant scope

  • BicepDeploy supports deployment Stacks


Another fantastic benefit of the BicepDeploy task is that it will automatically convert any Outputs in your Bicep code into Task Outputs in Azure DevOps. That means you can easily reference those outputs from subsequent tasks in your Pipeline.


This article assumes you already know how to work with YAML-based Azure DevOps Pipelines. This will not be a guide to using YAML, nor will it be a guide to building a full Azure DevOps Pipeline. If you'd like more information on that subject, please see my series on Azure DevOps YAML Pipelines.



Deploying to a Resource Group


This section goes over how to use the task to deploy a Bicep file that has a targetScope set to resourceGroup. Remember, if your Bicep file does not have a targetScope line at the top, then by default, the value of resourceGroup is automatically used. Here are all of the options that apply when doing a Resource Group deployment.



  • scope 

    • This must be set to resourceGroup

    • This is optional. If omitted, the default value of resourceGroup will be used

  • subscriptionId

    • Enter in the Subscription ID that contains the Resource Group that you are deploying to.

  • resourceGroupName

    • Enter the name of the Resource Group that you are deploying to.

    • This Resource Group must already exist, the Task will not create this for you.



Deploying to a Subscription


This section goes over how to use the task to deploy a Bicep file that has a targetScope set to subscription. Here are all of the options that apply when doing a Subscription deployment.



  • scope

    • Must be set to subscription

  • subscriptionId

    • Enter the Subscription ID that you are deploying to

  • location

    • This specifies the region used to store data about your deployment



Deploying to a Management Group


This section goes over how to use the task to deploy a Bicep file that has a targetScope set to managementGroup. Here are all of the options that apply when doing a Management Group deployment.



  • scope

    • Must be set to managementGroup

  • managementGroupId

    • Enter the Management Group ID that you are deploying to

  • location

    • This specifies the region used to store data about your deployment



Deploying to a Tenant


This section goes over how to use the task to deploy a Bicep file that has a targetScope set to tenant. In order to deploy at the Tenant scope, the Service Connection's associated identity must have the proper permissions at the Tenant level. Please see the Microsoft docs for more information about this.


Here are all of the options that apply when doing a Tenant deployment.



  • scope

    • Must be set to tenant

  • tenantId

    • Enter the Tenant ID that you are deploying to

  • location

    • This specifies the region used to store data about your deployment



Options that are common to all 3 Deployment Scopes



  • ConnectedServiceName

    • Enter the name of the Azure DevOps Service Connection that will be used for this deployment

    • An alias that can be used in place of this is azureResourceManagerConnection

  • bicepVersion

    • The bicep version to use.

    • This is optional. If omitted, the latest version will be used.

  • type

    • This should be set to deployment for a standard deployment.

    • This can also be set to deploymentStack if you are deploying to a stacks. Stacks are not covered in this article.

    • This is optional. If omitted, the default value of deployment will be used.

  • operation

    • This specifies the operation that you would like to perform for this deployment, and the options include create, validate, or whatIf.

    • This is optional. If omitted, the default value of create will be used.

  • name

    • This specifies the name for this deployment. You may need to reference this deployment in the future, so it can be beneficial to use good names here

    • This is optional. If omitted, a default value of azure-bicep-deploy will be used. Make sure to also read the next bullet point!

    • If you use the same deployment name over and over, then you will be restricted to viewing information about the latest deployment only. In other words, new deployments will overwrite the deployment data of old deployments if you use the same deployment name

  • description

    • This specifies the description for this deployment.

  • templateFile

    • Specifies the path to the bicep file that you would like to deploy.

  • parametersFile

    • Specifies the path to the parameters file that you would like to deploy.

    • Supports either .bicepparam files or .json files.

    • This is optional. Either your deployment doesn't need parameters or you're supplying parameters in a different way.

  • parameters

    • This let's you provide parameter values to your Bicep template via the Azure DevOps Pipelines task. This gives you the benefit of being able to use Pipeline variables and/or Pipeline parameters

    • This can be specified as a YAML object

    • This can also be specified as a single JSON string value, but you can include multiple different parameters in the same string. For example: parameters: {"param1": "value1", "param2": "value2"}

    • Parameter values entered this way take precedence over values supplied with a parameters file.

    • This is optional. Either your deployment doesn't need parameters or you're supplying parameters in a different way.

  • maskedOutputs

    • If your Bicep file contains Outputs with sensitive values, then you can tell the BicepDeploy task to mask those values with this option.

    • This specifies a comma-separate list of output names that will be masked.

  • environment

    • This specifies the Azure environment to deploy to, and the options include azureCloud, azureChinaCloud, azureGermanCloud, or azureUSGovernment.

    • This is optional. If omitted, then the default value of azureCloud is used.

  • whatIfExcludeChangeTypes

    • Only for deployments that use operation: whatIf

    • This specifies a comma-separated list of change types to exclude

  • validationLevel

    • Only for deployments that use operation: whatIf or operation: validate

    • This specifies the validation level to use, and the options include provider, providerNoRbac, or template.



Examples of minimal deployment commands




Deployment Stacks


Deployment Stacks are supported with this Task.


Please see Part 6 for more information on Deployment Stacks.



Well, that covers most of the basics of deploying Bicep files with the BicepDeploy task for Azure DevOps Pipelines.


That marks the end of my Bicep deployment series (for now). Thank you for reading!



My Bicep Deployment series:


 
 
 

Comments

bottom of page