JiT access policy from ARM to Bicep error

[mikenelson-io]

I've been researching this & still looking, but thought I would try here -
I have an ARM template that defines a JiT policy for a managed app. After a decompile by bicep, I get the message
The property "jitAccessPolicy" is not allowed on objects of type "ApplicationProperties". Permissible properties include "applicationDefinitionId", "uiDefinitionUri".bicep(BCP038)
The jitAccessPolicy is defined like this in the ARM template:

"jitAccessPolicy": {
            "type": "object",
            "defaultValue": {
                "jitAccessEnabled": false
            }

And like this for the parameters json:

"jitAccessPolicy": {
            "value": {
                "jitAccessEnabled": true,
                "jitApprovalMode": "AutoApprove",
                "maximumJitAccessDuration": "PT8H",
                "jitApprovers": []
            }

Is this a limitation of bicep, or do I need to adjust something to accommodate the object type? Apologies if I am missing the obvious.
Thanks for the help!

[alex-frankel]

is jitAccessPolicy in the sample above defined as a parameter in the template? Is the decompile command emitting the .bicep file or is that not being output?

[mikenelson-io]

Thanks for the reply!

The jitAccessPolicy is being defined as a parameter in the template file, as shown:
"jitAccessPolicy": "[parameters('jitAccessPolicy')]"

The .bicep file is being created, just with the error.
I did find this property though, so this might be my answer. Just not sure yet how to implement it - https://github.com/Azure/bicep-types-az/blob/main/generated/resources/microsoft.solutions/2019-07-01/types.md#applicationjitaccesspolicy

[anthony-c-martin]

Which version of the resource are you using in your Bicep resource declaration? Does switching to 'Microsoft.Solutions/applications@2019-07-01' help?

[mikenelson-io]

Yes, that did help & I think I have it now that I've added that resource with that version.
Appreciate all the help!

[brwilkinson]

Hi @mikenelson-io it appears that changing the api version was the answer that you needed in this case.

If you are happy with this, would you mind marking the solutions as answered above?