Output resulting from az deployment sub what-if calls contain unresolved Bicep function calls

[MonkeyTennis]

Describe the bug

In Bicep, the following function call can be used to render the resource group location:

"location": resourceGroup().location

The json file resulting from the what-if simulation should contain the result of the function call:

"location": "uksouth"

This has always been the case until yesterday where the output now contains the function call rather than the result of the function call. Moreover, the behaviour is intermittent and is also inconsistent.

For example, we have a Cosmos DB declaration that looks like the following (I have removed all other properties for purpose of clarity):

resource cosmos 'Microsoft.DocumentDB/databaseAccounts@2024-11-15' = {
  location: resourceGroup().location
  properties: {
    locations: [
      {
        locationName: resourceGroup().location
      }
    ]
  }
}

In the what-if output this appears as:

  location: "uksouth"
  properties: {
    locations: [
      {
        locationName: resourceGroup().location
      }
    ]
  }

i.e. - in the location property we get the result of the function call but in locationName we get the unresolved function call.

Also, whilst this happens > 90% of the time there have been a few occasions where locationName correctly included the result of the function call.

Related command

az deployment sub what-if

Errors

Thew command does not fail. However, the output has changed and because we inspect the output during our testing process, in order to ensure that resources are correctly defined, our testing process is currently blocked.

Issue script & Debug output

DEBUG: cli.knack.cli: Command arguments: ['deployment', 'sub', 'what-if', '--location', 'UKSouth', '-n', 'wibble', '-f', '', '-p', '', '--no-pretty-print', '--debug']
DEBUG: cli.knack.cli: init debug log:
Cannot enable color.
DEBUG: cli.knack.cli: Event: Cli.PreExecute []
DEBUG: cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x00000186E36C32E0>, <function OutputProducer.on_global_arguments at 0x00000186E385C180>, <function CLIQuery.on_global_arguments at 0x00000186E3881580>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
DEBUG: cli.azure.cli.core: Modules found from index for 'deployment': ['azure.cli.command_modules.resource']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: resource 0.691 52 232
DEBUG: cli.azure.cli.core: Total (1) 0.691 52 232
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: Total (0) 0.000 0 0
DEBUG: cli.azure.cli.core: Loaded 52 groups, 232 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : deployment sub what-if
DEBUG: cli.azure.cli.core: Command table: deployment sub what-if
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x00000186E5B4B100>]
DEBUG: cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '\2025-07-02.18-05-09.deployment_sub_what-if.241868.log'.
INFO: az_command_data_logger: command args: deployment sub what-if --location {} -n {} -f {} -p {} --no-pretty-print --debug
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument..add_subscription_parameter at 0x00000186E5C4E200>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument..add_ids_arguments at 0x00000186E5C4E2A0>, <function register_cache_arguments..add_cache_arguments at 0x00000186E5C4E3E0>, <function register_upcoming_breaking_change_info..update_breaking_change_info at 0x00000186E5C4E480>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x00000186E385C220>, <function CLIQuery.handle_query_parameter at 0x00000186E3881620>, <function register_ids_argument..parse_ids_arguments at 0x00000186E5C4E340>]
DEBUG: cli.azure.cli.command_modules.resource._bicep: Current value of "use_binary_from_path": false.
DEBUG: cli.azure.cli.command_modules.resource._bicep: Bicep CLI installation path: C:\Users\bcotier.azure\bin\bicep.exe
DEBUG: cli.azure.cli.command_modules.resource._bicep: Bicep CLI installed: True.
WARNING: cli.azure.cli.command_modules.resource._bicep: : Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'actionGroup'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'actionGroup'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'eventHub'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'premiumEventHub'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'premiumsaEventHub'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'premiumEventHub'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

: Warning no-unnecessary-dependson: Remove unnecessary dependsOn entry 'premiumEventHub'. [https://aka.ms/bicep/linter/no-unnecessary-dependson]

DEBUG: cli.azure.cli.core.util: attempting to read file as utf-8-sig
DEBUG: cli.azure.cli.core.commands.client_factory: Getting management service client client_type=ResourceManagementClient
DEBUG: cli.azure.cli.core.auth.persistence: build_persistence: location='\.azure\msal_token_cache.bin', encrypt=True
DEBUG: cli.azure.cli.core.auth.binary_cache: load: C:\Users\bcotier.azure\msal_http_cache.bin
DEBUG: urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
DEBUG: msal.authority: Initializing with Entra authority:
DEBUG: msal.authority:
DEBUG: msal.application: Broker enabled? True
DEBUG: cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token_info: scopes=('https://management.core.windows.net//.default',), options={}
DEBUG: cli.azure.cli.core.auth.msal_credentials: UserCredential.acquire_token: scopes=['https://management.core.windows.net//.default'], claims_challenge=None, kwargs={}
DEBUG: msal.application: Cache hit an AT
DEBUG: msal.telemetry: Generate or reuse correlation_id: 5b00fcb2-d1d5-4d04-a9ee-f57fef2ea2ba
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'POST'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '1106510'
DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.command_modules.resource.custom: HTTP content is being overwritten to preserve template whitepace accurately. The request body logging may not accurately represent this.
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-writes': '199'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-writes': '2999'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '8686e0ea-9de0-4ebc-af29-6f04948e39d1'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '8686e0ea-9de0-4ebc-af29-6f04948e39d1'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170518Z:8686e0ea-9de0-4ebc-af29-6f04948e39d1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 463B60072C7C43B195EE80D50A034A32 Ref B: AMS231032609033 Ref C: 2025-07-02T17:05:17Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:05:18 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies: Body is streamable
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '02e08a75-73e0-4a22-a0d9-be25596bdf93'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '02e08a75-73e0-4a22-a0d9-be25596bdf93'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170518Z:02e08a75-73e0-4a22-a0d9-be25596bdf93'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 34C84BD24F58413D9CD9B8F2A5D69625 Ref B: AMS231032609033 Ref C: 2025-07-02T17:05:18Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:05:18 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '241cba79-8aa7-4d3b-a7b2-673bbe67b105'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '241cba79-8aa7-4d3b-a7b2-673bbe67b105'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170533Z:241cba79-8aa7-4d3b-a7b2-673bbe67b105'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: E4064BD36DD9450498F078FBCA74B284 Ref B: AMS231032609033 Ref C: 2025-07-02T17:05:33Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:05:33 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location': '
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '80be9d27-8e75-436f-942a-b456d167326e'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '80be9d27-8e75-436f-942a-b456d167326e'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170548Z:80be9d27-8e75-436f-942a-b456d167326e'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 4AAF6B79B6B54282BF165C77A673F184 Ref B: AMS231032609033 Ref C: 2025-07-02T17:05:48Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:05:48 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '3f4c4087-66ec-414a-a635-f5d8168a2315'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '3f4c4087-66ec-414a-a635-f5d8168a2315'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170604Z:3f4c4087-66ec-414a-a635-f5d8168a2315'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: E5F477EABFDC415DB9F84106BF63D6D9 Ref B: AMS231032609033 Ref C: 2025-07-02T17:06:03Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:06:04 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'a3c5c166-afb5-4684-a3cc-17c5dcc5b348'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'a3c5c166-afb5-4684-a3cc-17c5dcc5b348'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170619Z:a3c5c166-afb5-4684-a3cc-17c5dcc5b348'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 47328348B3E4498299E6E98B2EB7A46B Ref B: AMS231032609033 Ref C: 2025-07-02T17:06:19Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:06:19 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 202
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'Location':
DEBUG: cli.azure.cli.core.sdk.policies: 'Retry-After': '15'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '1cae9cbc-e3be-4448-9af0-6993320fb14f'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '1cae9cbc-e3be-4448-9af0-6993320fb14f'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170634Z:1cae9cbc-e3be-4448-9af0-6993320fb14f'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: B4EABBB5230946C797E08E3D30C46C3A Ref B: AMS231032609033 Ref C: 2025-07-02T17:06:34Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:06:34 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '0'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.azure.cli.core.sdk.policies:
DEBUG: cli.azure.cli.core.sdk.policies: Request URL:
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'b569c8d6-5766-11f0-bbad-6045bd13d200'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'deployment sub what-if'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--location -n -f -p --no-pretty-print --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.73.0 (MSI) azsdk-python-core/1.31.0 Python/3.12.8 (Windows-11-10.0.22631-SP0)'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': ''
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool:
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '2573851'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-reads': '249'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-global-reads': '3749'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'f5328275-a638-4093-924f-ca16bd22afbb'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'f5328275-a638-4093-924f-ca16bd22afbb'
DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20250702T170649Z:f5328275-a638-4093-924f-ca16bd22afbb'
DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-Cache': 'CONFIG_NOCACHE'
DEBUG: cli.azure.cli.core.sdk.policies: 'X-MSEdge-Ref': 'Ref A: 39D6D11A51FC47B9883C405CD8DE24CF Ref B: AMS231032609033 Ref C: 2025-07-02T17:06:49Z'
DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Wed, 02 Jul 2025 17:06:49 GMT'
DEBUG: cli.azure.cli.core.sdk.policies: Response content:
DEBUG: cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x00000186E5B73740>, <function x509_from_base64_to_hex_transform at 0x00000186E5B737E0>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnFilterResult []
DEBUG: cli.knack.cli: Event: Cli.SuccessfulExecute []
DEBUG: cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x00000186E5B4B380>]
INFO: az_command_data_logger: exit code: 0
INFO: cli.main: Command ran in 101.976 seconds (init: 0.446, invoke: 101.530)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1
INFO: telemetry.save: Save telemetry record of length 3934 in cache file under C:\Users\bcotier.azure\telemetry\20250702180650757
INFO: telemetry.main: Begin creating telemetry upload process.
INFO: telemetry.process: Creating upload process: "C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe C:\Program Files\Microsoft SDKs\Azure\CLI2\Lib\site-packages\azure\cli\telemetry_init.pyc C:\Users\bcotier.azure C:\Users\bcotier.azure\telemetry\20250702180650757"
INFO: telemetry.process: Return from creating process 247640
INFO: telemetry.main: Finish creating telemetry upload process.

Expected behavior

Bicep function calls should be resolved and the result included in what-if output

Environment Summary

azure-cli 2.73.0 *

core 2.73.0 *
telemetry 1.1.0

Extensions:
aks-preview 18.0.0b15
azure-devops 1.0.2
datafactory 1.0.4
kusto 0.5.0
support 2.0.1

Dependencies:
msal 1.32.3
azure-mgmt-resource 23.3.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\bcotier.azure'
Extensions directory 'C:\Users\bcotier.azure\cliextensions'

Python (Windows) 3.12.8 (tags/v3.12.8:2dc476b, Dec 3 2024, 19:30:04) [MSC v.1942 64 bit (AMD64)]

Legal docs and information: aka.ms/AzureCliLegal

Additional context

I tried v2.75.0 but the output was drastically different. I got a lot of warnings about removing nested deployments.

[azure-client-tools-bot-prd]

Hi @MonkeyTennis,

2.73.0 is not the latest Azure CLI(2.75.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/deployments-owners.

[khenFed]

I too have started experiencing issues with az deployment sub what-if... in the past couple of days, and believe the core issue to be the same:

• issues only occur for me on v2.74+
• as of 2 days ago, was succeeding on v2.73

However, there was a time it worked on v2.74, as we had DevOps pipelines run, which perform what-if checks on v2.74 which did succeed, so this issue perhaps isn't solely related to the CLI, but I don't have a way of finding out any more information, and the below only references the situation I find myself in now.

getting back to the core issue, which took a considerable amount of time due to the what-if deployments just returning "Internal Server Error" (more on this later).

I found that having the following param in my bicep module:

• param location string = replace(resourceGroup().location, ' ', '')
  would not be parsed correctly when this value was used to form part of the name of my storage account I was attempting to deploy, which would result in the what-if not including my storage account in the results as an addition (the storage account doesn't currently exist) but instead returns the following under 'diagnostics' (note this is running Azure CLI v2.75):

[format('/subscriptions/<obfuscated>/resourceGroups/My-Resource-Group/providers/{0}', concat('Microsoft.Storage/storageAccounts/', toLower(format('sad{0}', resourceGroup().location))))] (Unsupported) Changes to the resource declared at 'properties.template.resources.FunctionApp.properties.template.resources.storageAccount' on line 1 and column 1386 cannot be analyzed because its resource ID or API version cannot be calculated until the deployment is under way. Please see https://aka.ms/WhatIfUnidentifiableResource for more guidance

In our case, we were using the storageAccount resource as the scope for an RBAC assignment, and when this resource was included in the bicep file, the result of the what-if was then the dreaded "Internal Server Error"

For completeness, here's a somewhat-simple re-pro for this exact scenario:

//main.bicep
targetScope = 'subscription'

resource RG 'Microsoft.Resources/resourceGroups@2024-03-01' = {
  name: 'My-Resource-Group'
  location: 'Australia Southeast'
}

module FunctionApp './module.bicep' = {
scope: RG
}

//module.bicep
param location string = resourceGroup().location
var kind string = 'functionapp,linux'

var storageAccountName = toLower('sad${location}')

resource site 'Microsoft.Web/sites@2024-04-01' = {
  name: 'my-function-app'
  location: 'AustraliaEast'
  kind: kind
  identity: {
    type: 'SystemAssigned'
    }
  tags: null
}

resource storageAccount 'Microsoft.Storage/storageAccounts@2024-01-01' = {
  name: storageAccountName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind:'StorageV2'
}

finally, run it with the following:

az deployment sub what-if --location 'Australia Southeast' --template-file .\main.bicep

you'll see in CLI v2.75 that the storageAccount is not part of the what-if results, and instead has the diagnostic results as given above.

In module.bicep, if you then add the following to it:

var fnBlobDataContributor = 'ba92f5b4-2d11-453d-a403-e96b0029c9fe'

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: '123e4567-e89b-12d3-a456-426614174000'
  scope: storageAccount
  properties: {
    principalId: site.identity.principalId
    principalType: 'ServicePrincipal'
    roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', fnBlobDataContributor)
  }
}

and re-run the az command, the what-if will now result in an "Internal Server Error" (and I assume this is the case as the what-if can't process the storage account resource due to the nature of using resourceGroup().location to help form part of the name.
(Disclaimer: this example is very cut-down from other complexities, and any issues around the format and length of the storage account name that would be an issue here are not actual issues for my "real" bicep code, and the way it's configured here still re-produces the underlying issue).

In Summary, the change to the CLI, and perhaps some processing behind the scenes with other modules, is no longer resulting in values parsing as expected, which causes these follow-on effects.

Sadly this issue broke several of our deployment pipelines and has taken me 2 days to get to this point, due to the complexity of our pipelines and complete lack of detailed error reporting, or any way to find out more information (as this is not an actual deployment). For the record, performing an actual deployment succeeds, so I was unable to ascertain more information through attempting a deployment (and then checking the Azure Portal for any additional detail).