Merge pull request #303921 from mumian/0804-linter-ps

Add new linter rule for using recent AZ PowerShell

Author: JamesJBarnett

articles/azure-resource-manager/bicep/bicep-functions-files.md

@@ -221,7 +221,7 @@ resource exampleScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
     }
   }
   properties: {
-    azPowerShellVersion: '8.3'
+    azPowerShellVersion: '14.0'
     scriptContent: loadTextContent('myscript.ps1')
     retentionInterval: 'P1D'
   }

articles/azure-resource-manager/bicep/deployment-script-bicep.md

@@ -110,7 +110,7 @@ resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
   location: location
   kind: 'AzurePowerShell'
   properties: {
-    azPowerShellVersion: '10.0'
+    azPowerShellVersion: '14.0'
     arguments: '-name ${name}'
     scriptContent: '''
       param([string] $name)
@@ -253,7 +253,7 @@ resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
   location: location
   kind: 'AzurePowerShell'
   properties: {
-    azPowerShellVersion: '10.0'
+    azPowerShellVersion: '14.0'
     arguments: '-name ${name}'
     scriptContent: '''
       param([string] $name)
@@ -374,7 +374,7 @@ SubscriptionId      : aaaa0a0a-bb1b-cc2c-dd3d-eeeeee4e4e4e
 ProvisioningState   : Succeeded
 Identity            :
 ScriptKind          : AzurePowerShell
-AzPowerShellVersion : 10.0
+AzPowerShellVersion : 14.0
 StartTime           : 12/11/2023 9:45:50 PM
 EndTime             : 12/11/2023 9:46:59 PM
 ExpirationDate      : 12/11/2023 10:46:59 PM

articles/azure-resource-manager/bicep/deployment-script-develop.md

@@ -3,7 +3,7 @@ title: Develop a deployment script in Bicep
 description: Learn how to develop a deployment script within a Bicep file or store one externally as a separate file.
 ms.custom: devx-track-bicep
 ms.topic: conceptual
-ms.date: 07/25/2025
+ms.date: 08/06/2025
 ---
 
 # Develop a deployment script in Bicep
@@ -121,10 +121,9 @@ In your deployment script, specify these property values:
 
     See a list of [supported Azure PowerShell versions](https://mcr.microsoft.com/v2/azuredeploymentscripts-powershell/tags/list). The version determines which container image to use:
 
-    - Az version *greater than or equal to 9* uses Ubuntu 22.04.
-    - Az version *greater than or equal to 6 but less than 9* uses Ubuntu 20.04.
-    - Az version *less than 6* uses Ubuntu 18.04.
-
+    - Az version *greater than or equal to 12 uses Ubuntu 24.04.
+    - Az version *greater than or equal to 9* but less than 12 uses Ubuntu 22.04.
+    
     > [!IMPORTANT]
     > We advise you to upgrade to the latest version of Ubuntu. Ubuntu 18.04 is nearing its end of support and won't receive security updates after [May 31, 2023](https://ubuntu.com/18-04).
 

articles/azure-resource-manager/bicep/deployment-script-vnet-private-endpoint.md

@@ -190,7 +190,7 @@ resource privateDeploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-
         }
       ]
     }
-    azPowerShellVersion: '9.0'
+    azPowerShellVersion: '14.0'
     retentionInterval: 'P1D'
     scriptContent: 'Write-Host "Hello World!"'
   }

articles/azure-resource-manager/bicep/linter-rule-use-recent-az-powershell-version.md

@@ -0,0 +1,69 @@
+---
+title: Linter rule - use recent AZ PowerShell version for deployment scripts
+description: Linter rule - use recent AZ PowerShell version for deployment scripts
+ms.topic: reference
+ms.custom: devx-track-bicep
+ms.date: 08/05/2025
+---
+
+# Linter rule - use recent AZ PowerShell version for deployment scripts
+
+This rule checks for AZ PowerShell versions below 11.0. It is recommended to use AZ PowerShell version 14.0.
+
+## Linter rule code
+
+Use the following value in the [Bicep configuration file](bicep-config-linter.md) to customize rule settings:
+
+`use-recent-az-powershell-version`
+
+## Solution
+
+The following example doesn't pass this test because the `azPowerShellVersion` value is `10.4`:
+
+```bicep
+param location string = resourceGroup().location
+ 
+resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
+  name: 'inlinePS'
+  location: location
+  kind: 'AzurePowerShell'
+  properties: {
+    azPowerShellVersion: '10.4'
+    scriptContent: '''
+      $output = 'Hello world!'
+      $DeploymentScriptOutputs = @{}
+      $DeploymentScriptOutputs['text'] = $output
+    '''
+    retentionInterval: 'PT1H'
+  }
+}
+ 
+output result string = deploymentScript.properties.outputs.text
+```
+
+Fix the problem by using version 11.0 or later:
+
+```bicep
+param location string = resourceGroup().location
+ 
+resource deploymentScript 'Microsoft.Resources/deploymentScripts@2023-08-01' = {
+  name: 'inlinePS'
+  location: location
+  kind: 'AzurePowerShell'
+  properties: {
+    azPowerShellVersion: '14.0'
+    scriptContent: '''
+      $output = 'Hello world!'
+      $DeploymentScriptOutputs = @{}
+      $DeploymentScriptOutputs['text'] = $output
+    '''
+    retentionInterval: 'PT1H'
+  }
+}
+ 
+output result string = deploymentScript.properties.outputs.text
+```
+
+## Next steps
+
+Learn more in [Use Bicep linter](./linter.md).

articles/azure-resource-manager/bicep/linter.md

@@ -51,6 +51,7 @@ The default set of linter rules is minimal and taken from [arm-ttk test cases](.
 | <a id='simplify-json-null' />[simplify-json-null](./linter-rule-simplify-json-null.md) | warning |
 | <a id='use-parent-property' />[use-parent-property](./linter-rule-use-parent-property.md) | warning |
 | <a id='use-recent-api-versions' />[use-recent-api-versions](./linter-rule-use-recent-api-versions.md) | off |
+| <a id='use-recent-az-powershell-version' />[use-recent-az-powershell-version](./linter-rule-use-recent-az-powershell-version.md) | warning |
 | <a id='use-recent-module-versions' />[use-recent-module-versions](./linter-rule-use-recent-module-versions.md) | off |
 | <a id='use-resource-id-functions' />[use-resource-id-functions](./linter-rule-use-resource-id-functions.md) | off |
 | <a id='use-resource-symbol-reference' />[use-resource-symbol-reference](./linter-rule-use-resource-symbol-reference.md) | warning |

articles/azure-resource-manager/bicep/toc.yml

@@ -549,6 +549,9 @@ items:
       - name: Use recent API versions
         displayName: linter
         href: linter-rule-use-recent-api-versions.md
+      - name: Use recent AZ PowerShell version
+        displayName: linter
+        href: linter-rule-use-recent-az-powershell-version.md
       - name: Use recent module versions
         displayName: linter
         href: linter-rule-use-recent-module-versions.md

articles/azure-resource-manager/templates/deployment-script-template.md

@@ -113,7 +113,7 @@ The following JSON is an example. For more information, see the latest [template
       "storageAccountName": "myStorageAccount",
       "storageAccountKey": "myKey"
     },
-    "azPowerShellVersion": "9.7",  // or "azCliVersion": "2.47.0",
+    "azPowerShellVersion": "14.0",  // or "azCliVersion": "2.47.0",
     "arguments": "-name \\\"John Dole\\\"",
     "environmentVariables": [
       {
@@ -402,7 +402,7 @@ SubscriptionId      : aaaabbbb-0000-cccc-1111-dddd2222eeee
 ProvisioningState   : Succeeded
 Identity            : /subscriptions/aaaabbbb-0000-cccc-1111-dddd2222eeee/resourceGroups/mydentity1008rg/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myuami
 ScriptKind          : AzurePowerShell
-AzPowerShellVersion : 9.7
+AzPowerShellVersion : 14.0
 StartTime           : 5/11/2023 7:46:45 PM
 EndTime             : 5/11/2023 7:49:45 PM
 ExpirationDate      : 5/12/2023 7:49:45 PM
@@ -541,7 +541,7 @@ The output is similar to:
   "properties": {
     "provisioningState": "Succeeded",
     "forceUpdateTag": "20220625T025902Z",
-    "azPowerShellVersion": "9.7",
+    "azPowerShellVersion": "14.0",
     "scriptContent": "\r\n          param([string] $name)\r\n          $output = \"Hello {0}\" -f $name\r\n          Write-Output $output\r\n          $DeploymentScriptOutputs = @{}\r\n          $DeploymentScriptOutputs['text'] = $output\r\n        ",
     "arguments": "-name \\\"John Dole\\\"",
     "retentionInterval": "P1D",