Skill 47 · Azure Deployment Preflight
Subchapter 47.3
references/VALIDATION-COMMANDS.mdMarkdown8 KBView on GitHub
This reference documents all commands used for Azure deployment preflight validation.
Preview infrastructure changes for azd projects without deploying.
azd provision --preview [options]Options:
| Option | Description |
|---|---|
--environment, -e | Name of the environment to use |
--no-prompt | Accept defaults without prompting |
--debug | Enable debug logging |
--cwd | Set working directory |
Examples:
# Preview with default environment
azd provision --preview
# Preview specific environment
azd provision --preview --environment dev
# Preview without prompts (CI/CD)
azd provision --preview --no-promptOutput: Shows resources that will be created, modified, or deleted.
Authenticate to Azure for azd operations.
azd auth login [options]Options:
| Option | Description |
|---|---|
--check-status | Check login status without logging in |
--use-device-code | Use device code flow |
--tenant-id | Specify tenant |
--client-id | Service principal client ID |
List available environments.
azd env listPreview changes for resource group deployments.
az deployment group what-if \
--resource-group <rg-name> \
--template-file <bicep-file> \
[options]Required Parameters:
| Parameter | Description |
|---|---|
--resource-group, -g | Target resource group name |
--template-file, -f | Path to Bicep file |
Optional Parameters:
| Parameter | Description |
|---|---|
--parameters, -p | Parameter file or inline values |
--validation-level | Provider (default), ProviderNoRbac, or Template |
--result-format | FullResourcePayloads (default) or ResourceIdOnly |
--no-pretty-print | Output raw JSON for parsing |
--name, -n | Deployment name |
--exclude-change-types | Exclude specific change types from output |
Validation Levels:
| Level | Description | Use Case |
|---|---|---|
Provider | Full validation with RBAC checks | Default, most thorough |
ProviderNoRbac | Full validation, read permissions only | When lacking deploy permissions |
Template | Static syntax validation only | Quick syntax check |
Examples:
# Basic what-if
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep
# With parameters and full validation
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level Provider
# Fallback without RBAC checks
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--validation-level ProviderNoRbac
# JSON output for parsing
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--no-pretty-printPreview changes for subscription-level deployments.
az deployment sub what-if \
--location <location> \
--template-file <bicep-file> \
[options]Required Parameters:
| Parameter | Description |
|---|---|
--location, -l | Location for deployment metadata |
--template-file, -f | Path to Bicep file |
Examples:
az deployment sub what-if \
--location eastus \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level ProviderPreview changes for management group deployments.
az deployment mg what-if \
--location <location> \
--management-group-id <mg-id> \
--template-file <bicep-file> \
[options]Required Parameters:
| Parameter | Description |
|---|---|
--location, -l | Location for deployment metadata |
--management-group-id, -m | Target management group ID |
--template-file, -f | Path to Bicep file |
Preview changes for tenant-level deployments.
az deployment tenant what-if \
--location <location> \
--template-file <bicep-file> \
[options]Required Parameters:
| Parameter | Description |
|---|---|
--location, -l | Location for deployment metadata |
--template-file, -f | Path to Bicep file |
Authenticate to Azure CLI.
az login [options]Options:
| Option | Description |
|---|---|
--tenant, -t | Tenant ID or domain |
--use-device-code | Use device code flow |
--service-principal | Login as service principal |
Display current subscription context.
az account showCheck if resource group exists.
az group exists --name <rg-name>Compile Bicep to ARM JSON and validate syntax.
bicep build <bicep-file> [options]Options:
| Option | Description |
|---|---|
--stdout | Output to stdout instead of file |
--outdir | Output directory |
--outfile | Output file path |
--no-restore | Skip module restore |
Examples:
# Validate syntax (output to stdout, no file created)
bicep build main.bicep --stdout > /dev/null
# Build to specific directory
bicep build main.bicep --outdir ./build
# Validate multiple files
for f in *.bicep; do bicep build "$f" --stdout; doneError Output Format:
/path/to/file.bicep(22,51) : Error BCP064: Found unexpected tokens in interpolated expression.
/path/to/file.bicep(22,51) : Error BCP004: The string at this location is not terminated.Format: <file>(<line>,<column>) : <severity> <code>: <message>
Check Bicep CLI version.
bicep --versionModern Bicep parameter files (recommended):
using './main.bicep'
param location = 'eastus'
param environment = 'dev'
param tags = {
environment: 'dev'
project: 'myapp'
}Detection pattern: <template-name>.bicepparam
Traditional ARM parameter files:
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"location": { "value": "eastus" },
"environment": { "value": "dev" }
}
}Detection patterns:
<template-name>.parameters.jsonparameters.jsonparameters/<env>.json# Bicep parameters file
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--parameters main.bicepparam
# JSON parameters file
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--parameters @parameters.json
# Inline parameter overrides
az deployment group what-if \
--resource-group my-rg \
--template-file main.bicep \
--parameters main.bicepparam \
--parameters location=westusCheck the Bicep file’s targetScope declaration:
// Resource Group (default if not specified)
targetScope = 'resourceGroup'
// Subscription
targetScope = 'subscription'
// Management Group
targetScope = 'managementGroup'
// Tenant
targetScope = 'tenant'Scope to Command Mapping:
| targetScope | Command | Required Parameters |
|---|---|---|
resourceGroup | az deployment group what-if | --resource-group |
subscription | az deployment sub what-if | --location |
managementGroup | az deployment mg what-if | --location, --management-group-id |
tenant | az deployment tenant what-if | --location |
| Tool | Minimum Version | Recommended Version | Key Features |
|---|---|---|---|
| Azure CLI | 2.14.0 | 2.76.0+ | --validation-level switch |
| Azure Developer CLI | 1.0.0 | Latest | --preview flag |
| Bicep CLI | 0.4.0 | Latest | Best error messages |
Check versions:
az --version
azd version
bicep --version