[BUG] Missing @maxLength(25) on ScheduledActionProperties.displayName in models.tsp

Update:

The product team shared the following comment –

We had to add extra validations in Views and Scheduled actions due to recent phishing attempts on our service. This is a new change we have not yet make doc updates and was done as part of a fraud mitigation effort. For scheduled actions, the change is currently rolling out

API Spec link

https://github.com/Azure/azure-rest-api-specs/blob/main/specification/cost-management/resource-manager/Microsoft.CostManagement/CostManagement/models.tsp

API Spec version

2022-10-01 (also affects all versions through 2025-03-01)

Describe the bug

The displayName property in ScheduledActionProperties (models.tsp) is defined as a plain string with no @maxLength decorator:

model ScheduledActionProperties {
Scheduled action name.
displayName: string;

However, the Azure server enforces a 25-character maximum and returns:
"Scheduled action display name length exceeds the allowed limit of 25 characters. Please shorten the display name."

This constraint is missing from:

• The TypeSpec definition (models.tsp)
• All generated OpenAPI/Swagger specs (scheduledActions.json for every version from 2022-06-01-preview to 2025-03-01)
• All public REST API documentation on learn.microsoft.com
• The API changelog (https://learn.microsoft.com/en-us/azure/templates/microsoft.costmanagement/change-log/scheduledactions)

Other properties in NotificationProperties mention their limits in descriptions (subject: 70 chars, message: 250 chars) but also lack actual @maxLength decorators.

Microsoft's own documentation example uses "Monthly Cost By Resource" which is exactly 25 characters — barely passing the hidden limit.

Expected behavior

The TypeSpec definition should include the @maxLength(25) decorator on displayName so the constraint is:

1. Visible in generated documentation
2. Propagated to generated OpenAPI specs as "maxLength": 25
3. Enforced at compile time by Bicep, ARM templates, and Terraform
4. Consistent with actual server-side behavior

Expected fix in models.tsp:

model ScheduledActionProperties {
Scheduled action name. Length is limited to 25 characters.
@maxLength(25)
displayName: string;

Actual behavior

• displayName is defined as plain "string" with no length constraint in models.tsp
• The generated scheduledActions.json for all versions (stable/2022-10-01, stable/2023-03-01, stable/2023-08-01, stable/2023-09-01, stable/2023-11-01, stable/2024-08-01, stable/2025-03-01, and all previews) have no maxLength on the displayName property in ScheduledActionProperties
• The server silently enforces a 25-character limit and rejects longer values with HTTP 400 BadRequest
• No changelog entry documents when this validation was introduced or enforced
• Bicep deployments fail at runtime instead of at compile time because the Bicep type system has no maxLength constraint to validate against
• This is a silent breaking change — deployments that previously succeeded now fail

Reproduction Steps

1. Create a Bicep file targeting subscription scope:

resource scheduledAction 'Microsoft.CostManagement/scheduledActions@2022-10-01' = {
  name: 'dailyanomalybyresourcegroup'
  kind: 'InsightAlert'
  properties: {
    displayName: 'Daily anomaly by resource group'  // 35 chars - exceeds hidden 25-char limit
    status: 'Enabled'
    viewId: '${subscription().id}/providers/Microsoft.CostManagement/views/ms:DailyAnomalyByResourceGroup'
    notification: {
      subject: 'Daily anomaly by resource group'
      to: ['user@example.com']
    }
    notificationEmail: 'user@example.com'
    schedule: {
      frequency: 'Daily'
      startDate: '2026-04-08T08:00Z'
      endDate: '2030-04-08T08:00Z'
    }
  }
}

2. Deploy to Azure:

   • Bicep compilation succeeds (no maxLength validation exists)
   • ARM template validation succeeds

3. ARM deployment FAILS with BadRequest:

   "Scheduled action display name length exceeds the allowed limit of 25 characters. Please shorten the display name."

4. Changing displayName to 'Daily Anomaly by RG' (19 chars) succeeds.

5. Verified the same behavior with the REST API directly:

   PUT https://management.azure.com/subscriptions/{subId}/providers/Microsoft.CostManagement/scheduledActions/dailyanomalybyresourcegroup?api-version=2022-10-01
   

   Same BadRequest error.

Environment

• Deployment method: Azure Bicep via Azure DevOps Pipelines
• Bicep resource type: Microsoft.CostManagement/scheduledActions@2022-10-01
• Region: Sweden Central
• Date first observed: April 8, 2026
• TypeSpec source file: specification/cost-management/resource-manager/Microsoft.CostManagement/CostManagement/models.tsp
• Property: ScheduledActionProperties.displayName
• Affected OpenAPI spec files:
  • stable/2022-10-01/scheduledActions.json
  • stable/2023-03-01/scheduledActions.json
  • stable/2023-08-01/scheduledActions.json
  • stable/2023-09-01/scheduledActions.json
  • stable/2023-11-01/scheduledActions.json
  • stable/2024-08-01/scheduledActions.json
  • stable/2025-03-01/scheduledActions.json (via examples/)
  • preview/2022-06-01-preview/scheduledActions.json
  • preview/2023-04-01-preview/scheduledActions.json
  • preview/2023-07-01-preview/scheduledActions.json
  • preview/2024-10-01-preview/scheduledActions.json

Start at specification/cost-management/resource-manager/Microsoft.CostManagement/CostManagement/models.tsp and inspect ScheduledActionProperties.displayName. Add the documented 25-character constraint, then verify that the affected stable and preview scheduledActions.json files expose maxLength 25 and that the public documentation and scheduled actions changelog reflect the limit. Done means the generated specifications match the server validation across the listed API versions.