aRM operations execute using the caller or workload identity's effective management permissions. In this case, an administrator wants to see proposed ARM/Bicep changes before deployment. “Grant the deployment principal the required Azure RBAC actions at target scope” would not satisfy that requirement; the supported action is “Run ARM deployment what-if for the target scope”. What-if compares desired declarations with current state before changes are applied.

scope determines where resource declarations are evaluated and created. In this case, an administrator wants to see proposed ARM/Bicep changes before deployment. “Set the module or deployment target scope to the intended resource group” would not satisfy that requirement; the supported action is “Run ARM deployment what-if for the target scope”. What-if compares desired declarations with current state before changes are applied.

bicep modules permit composition of related resource definitions under an orchestrating deployment. In this case, an administrator wants to see proposed ARM/Bicep changes before deployment. “Modules for separately reusable resource declarations” would not satisfy that requirement; the supported action is “Run ARM deployment what-if for the target scope”. What-if compares desired declarations with current state before changes are applied.

scope determines where resource declarations are evaluated and created. In this case, a template deployment fails because its identity lacks permission at the target resource group. “Set the module or deployment target scope to the intended resource group” would not satisfy that requirement; the supported action is “Grant the deployment principal the required Azure RBAC actions at target scope”. ARM operations execute using the caller or workload identity's effective management permissions.

what-if compares desired declarations with current state before changes are applied. In this case, a template deployment fails because its identity lacks permission at the target resource group. “Run ARM deployment what-if for the target scope” would not satisfy that requirement; the supported action is “Grant the deployment principal the required Azure RBAC actions at target scope”. ARM operations execute using the caller or workload identity's effective management permissions.

a required parameter must be provided or have a valid default for evaluation. In this case, a template deployment fails because its identity lacks permission at the target resource group. “The required template parameter has no supplied value” would not satisfy that requirement; the supported action is “Grant the deployment principal the required Azure RBAC actions at target scope”. ARM operations execute using the caller or workload identity's effective management permissions.

aRM operations execute using the caller or workload identity's effective management permissions. In this case, a reusable module needs to deploy into a specific resource group rather than the default subscription scope. “Grant the deployment principal the required Azure RBAC actions at target scope” would not satisfy that requirement; the supported action is “Set the module or deployment target scope to the intended resource group”. Scope determines where resource declarations are evaluated and created.

what-if compares desired declarations with current state before changes are applied. In this case, a reusable module needs to deploy into a specific resource group rather than the default subscription scope. “Run ARM deployment what-if for the target scope” would not satisfy that requirement; the supported action is “Set the module or deployment target scope to the intended resource group”. Scope determines where resource declarations are evaluated and created.

declarative deployment converges toward the target state rather than blindly creating duplicate named resources. In this case, a reusable module needs to deploy into a specific resource group rather than the default subscription scope. “Incremental reconciliation of the declared resource configuration” would not satisfy that requirement; the supported action is “Set the module or deployment target scope to the intended resource group”. Scope determines where resource declarations are evaluated and created.

resource references and explicit dependencies ensure resources are created in a valid order. In this case, a team wants separate reusable definitions for network and application resources. “Reference the subnet resource so deployment dependencies are established” would not satisfy that requirement; the supported action is “Modules for separately reusable resource declarations”. Bicep modules permit composition of related resource definitions under an orchestrating deployment.

scope determines where resource declarations are evaluated and created. In this case, a team wants separate reusable definitions for network and application resources. “Set the module or deployment target scope to the intended resource group” would not satisfy that requirement; the supported action is “Modules for separately reusable resource declarations”. Bicep modules permit composition of related resource definitions under an orchestrating deployment.

what-if compares desired declarations with current state before changes are applied. In this case, a team wants separate reusable definitions for network and application resources. “Run ARM deployment what-if for the target scope” would not satisfy that requirement; the supported action is “Modules for separately reusable resource declarations”. Bicep modules permit composition of related resource definitions under an orchestrating deployment.

aRM operations execute using the caller or workload identity's effective management permissions. In this case, a template refers to a parameter not supplied and no default exists. “Grant the deployment principal the required Azure RBAC actions at target scope” would not satisfy that requirement; the supported action is “The required template parameter has no supplied value”. A required parameter must be provided or have a valid default for evaluation.

resource references and explicit dependencies ensure resources are created in a valid order. In this case, a template refers to a parameter not supplied and no default exists. “Reference the subnet resource so deployment dependencies are established” would not satisfy that requirement; the supported action is “The required template parameter has no supplied value”. A required parameter must be provided or have a valid default for evaluation.

declarative deployment converges toward the target state rather than blindly creating duplicate named resources. In this case, a template refers to a parameter not supplied and no default exists. “Incremental reconciliation of the declared resource configuration” would not satisfy that requirement; the supported action is “The required template parameter has no supplied value”. A required parameter must be provided or have a valid default for evaluation.

secure parameter handling reduces accidental secret exposure during declarative deployments. In this case, a team wants a resource's connection string saved inside a shared template repository. “Use a supported secure parameter and protected secret source” would not satisfy that requirement; the supported action is “Embedding secrets as cleartext parameter defaults or source literals”. Infrastructure definitions should not store sensitive credentials in version-controlled text.

resource API versions determine available properties and validation for the provider type. In this case, a team wants a resource's connection string saved inside a shared template repository. “Use a supported resource-provider API version in the declaration” would not satisfy that requirement; the supported action is “Embedding secrets as cleartext parameter defaults or source literals”. Infrastructure definitions should not store sensitive credentials in version-controlled text.

declarative infrastructure code makes configuration changes reviewable and reproducible. In this case, a team wants a resource's connection string saved inside a shared template repository. “Version-controlled ARM templates or Bicep definitions” would not satisfy that requirement; the supported action is “Embedding secrets as cleartext parameter defaults or source literals”. Infrastructure definitions should not store sensitive credentials in version-controlled text.

resource API versions determine available properties and validation for the provider type. In this case, a deployment must retrieve a sensitive parameter without exposing it in ordinary template history. “Use a supported resource-provider API version in the declaration” would not satisfy that requirement; the supported action is “Use a supported secure parameter and protected secret source”. Secure parameter handling reduces accidental secret exposure during declarative deployments.

infrastructure definitions should not store sensitive credentials in version-controlled text. In this case, a deployment must retrieve a sensitive parameter without exposing it in ordinary template history. “Embedding secrets as cleartext parameter defaults or source literals” would not satisfy that requirement; the supported action is “Use a supported secure parameter and protected secret source”. Secure parameter handling reduces accidental secret exposure during declarative deployments.

declarative updates must respect immutable properties and current-state constraints. In this case, a deployment must retrieve a sensitive parameter without exposing it in ordinary template history. “The desired resource properties and actual resource state for that name” would not satisfy that requirement; the supported action is “Use a supported secure parameter and protected secret source”. Secure parameter handling reduces accidental secret exposure during declarative deployments.

secure parameter handling reduces accidental secret exposure during declarative deployments. In this case, a Bicep file compiles locally but deployment is denied by policy. “Use a supported secure parameter and protected secret source” would not satisfy that requirement; the supported action is “Azure Policy evaluation at the effective scope”. Syntactic correctness does not override organizational resource governance rules.

template export provides a starting declaration but may require cleanup before repeatable deployment. In this case, a Bicep file compiles locally but deployment is denied by policy. “Export its ARM template and review it before reuse” would not satisfy that requirement; the supported action is “Azure Policy evaluation at the effective scope”. Syntactic correctness does not override organizational resource governance rules.

declarative updates must respect immutable properties and current-state constraints. In this case, a Bicep file compiles locally but deployment is denied by policy. “The desired resource properties and actual resource state for that name” would not satisfy that requirement; the supported action is “Azure Policy evaluation at the effective scope”. Syntactic correctness does not override organizational resource governance rules.

bicep decompilation helps migrate templates but generated code still requires inspection. In this case, an operator needs to export an existing resource group's deployment configuration for reuse. “Decompile or convert ARM JSON to Bicep and review the result” would not satisfy that requirement; the supported action is “Export its ARM template and review it before reuse”. Template export provides a starting declaration but may require cleanup before repeatable deployment.

declarative infrastructure code makes configuration changes reviewable and reproducible. In this case, an operator needs to export an existing resource group's deployment configuration for reuse. “Version-controlled ARM templates or Bicep definitions” would not satisfy that requirement; the supported action is “Export its ARM template and review it before reuse”. Template export provides a starting declaration but may require cleanup before repeatable deployment.

resource API versions determine available properties and validation for the provider type. In this case, an operator needs to export an existing resource group's deployment configuration for reuse. “Use a supported resource-provider API version in the declaration” would not satisfy that requirement; the supported action is “Export its ARM template and review it before reuse”. Template export provides a starting declaration but may require cleanup before repeatable deployment.

declarative infrastructure code makes configuration changes reviewable and reproducible. In this case, an engineer receives an ARM JSON template and wants to maintain it in a simpler DSL. “Version-controlled ARM templates or Bicep definitions” would not satisfy that requirement; the supported action is “Decompile or convert ARM JSON to Bicep and review the result”. Bicep decompilation helps migrate templates but generated code still requires inspection.

template export provides a starting declaration but may require cleanup before repeatable deployment. In this case, an engineer receives an ARM JSON template and wants to maintain it in a simpler DSL. “Export its ARM template and review it before reuse” would not satisfy that requirement; the supported action is “Decompile or convert ARM JSON to Bicep and review the result”. Bicep decompilation helps migrate templates but generated code still requires inspection.

infrastructure definitions should not store sensitive credentials in version-controlled text. In this case, an engineer receives an ARM JSON template and wants to maintain it in a simpler DSL. “Embedding secrets as cleartext parameter defaults or source literals” would not satisfy that requirement; the supported action is “Decompile or convert ARM JSON to Bicep and review the result”. Bicep decompilation helps migrate templates but generated code still requires inspection.

secure parameter handling reduces accidental secret exposure during declarative deployments. In this case, a template has an unrecognized API version for a resource type. “Use a supported secure parameter and protected secret source” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.

declarative infrastructure code makes configuration changes reviewable and reproducible. In this case, a template has an unrecognized API version for a resource type. “Version-controlled ARM templates or Bicep definitions” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.

declarative updates must respect immutable properties and current-state constraints. In this case, a template has an unrecognized API version for a resource type. “The desired resource properties and actual resource state for that name” would not satisfy that requirement; the supported action is “Use a supported resource-provider API version in the declaration”. Resource API versions determine available properties and validation for the provider type.