Incremental deployments tries to delete privateDnsZoneConfigs in PrivateEndpoints

^{Originally posted by **swordfish291** September 15, 2023}
I am trying to deploy Azure OpenAI using bicep modules. The first deployment goes successful however, the subsequest incremental deployments tries to delete properties.privateDnsZoneConfigs Here is my bicep code:

```
resource openai_instance 'Microsoft.CognitiveServices/accounts@2023-05-01' = {
name: openAIInstanceName
location: location
tags: tags
sku: {
name: skuName
}
kind: 'OpenAI'
properties: {
disableLocalAuth: true
publicNetworkAccess: 'Disabled'
networkAcls: {
defaultAction: 'Deny'
}
customSubDomainName: toLower(openAIInstanceName)
}
}

resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
name: privateEndpointName
location: peplocation
tags: tags

properties: {
subnet: {
id: resourceId(vnetResourceGroup, 'Microsoft.Network/virtualNetworks/subnets', vnetName, subnetName)
}
privateLinkServiceConnections: [
{
name: 'openAIPrivateLinkConnection'
properties: {
privateLinkServiceId: openai_instance.id
groupIds: [
'account'
]
}
}
]
}
resource privateEndpointDnsEntry 'privateDnsZoneGroups@2023-04-01' = {
name: 'default'
properties: {
privateDnsZoneConfigs: [
{
name: 'config'
properties: {
privateDnsZoneId: PrivateDnsZoneId
}
}
]
}
}
}

var roleDefinitionResourceId = '/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd'

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
scope: openai_instance
name: guid(openai_instance.id, principalId, roleDefinitionResourceId)
properties: {
roleDefinitionId: roleDefinitionResourceId
principalId: principalId
principalType: principalType
}
}resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
scope: openai_instance
name: guid(openai_instance.id, principalId, roleDefinitionResourceId)
properties: {
roleDefinitionId: roleDefinitionResourceId
principalId: principalId
principalType: principalType
}
}

```

the subsequent incremental deployments without any change throw this what-if output:

```
Resource and property changes are indicated with these symbols:
- Delete
~ Modify
= Nochange
* Ignore
x Noeffect

The deployment will update the following scope:

Scope: /subscriptions/xxxxxxx/resourceGroups/open-ai-xxxx

~ Microsoft.CognitiveServices/accounts/openai-xxxxx/providers/Microsoft.Authorization/roleAssignments/9caf4209-xxxx-xxxxx-b7c5-b4b9f14xxxe9 [2022-04-01]
~ properties.roleDefinitionId: "/subscriptions/xxxxxxxxxxxx/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd" => "/providers/Microsoft.Authorization/roleDefinitions/5e0bd9bd-7b93-4f28-af87-19fc36ad61bd"
x properties.principalType: "Group"

~ Microsoft.Network/privateEndpoints/openai-xxxxxx-pep/privateDnsZoneGroups/default [2023-04-01]
~ properties.privateDnsZoneConfigs: [
~ 0:

- etag: "W/"047ed8f9-5291-43e0-87e0-4d03fecbe9fc""
- id: "/subscriptions/xxxxxxxxxx/resourceGroups/open-ai-xxxxx-rg/providers/Microsoft.Network/privateEndpoints/openai-xxxxx-pep/privateDnsZoneGroups/default/privateDnsZoneConfigs/config"
- properties.provisioningState: "Succeeded"
- type: "Microsoft.Network/privateEndpoints/privateDnsZoneGroups/privateDnsZoneConfigs"

]

= Microsoft.CognitiveServices/accounts/openai-xxxxx-01 [2023-05-01]
= Microsoft.Network/privateEndpoints/openai-xxxxx-pep [2023-04-01]
```