Add What-If Support for Microsoft Graph Resources in Azure Bicep
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 4h
- Merged PRs (30d)
- 81
Description
## Problem Statement
Currently, Azure Bicep's Microsoft Graph extension does not support what-if functionality for Microsoft Graph resources. When running New-AzDeployment or similar with what-if operations on templates containing Microsoft Graph resources, the following diagnostic warning occurs:
This limitation prevents proper impact assessment before deploying templates that include Entra ID groups, users, applications, and other Microsoft Graph resources.
I'm aware, that this is documented [here](https://learn.microsoft.com/en-us/graph/templates/bicep/limitations#unsupported-deployment-features). However, having this feature would be a great benefit for us.
## Current Impact
- Reduced deployment confidence: Teams cannot preview changes to Microsoft Graph resources before deployment
- Limited change validation: What-if analysis is incomplete when templates contain both Azure resources and Microsoft Graph resources
- Increased deployment risk: Potential for unexpected changes to Entra ID objects without preview capability
- Workflow inconsistency: Different preview capabilities for Azure vs. Microsoft Graph resources
## Requested Feature
Add comprehensive what-if support for all Microsoft Graph resource types in the Azure Bicep Microsoft Graph extension, including but not limited to all supported types like:
- Microsoft.Graph/groups@v1.0
- Microsoft.Graph/users@v1.0
- Microsoft.Graph/applications@v1.0
- Microsoft.Graph/servicePrincipals@v1.0
All other supported Microsoft Graph resource types
## Expected Behavior
When running what-if operations on templates containing Microsoft Graph resources, the output should:
- Show planned changes for Microsoft Graph resources (create, modify, delete)
- Display property-level differences for existing resources
- Indicate new resources that will be created
- Highlight resources that will be modified or deleted
- Provide the same level of detail as available for native Azure resources
- Example Use Case
Running Get-AzDeploymentWhatIfResult should show:
- If the group will be created (new resource)
- If members will be added/removed (property changes)
- If other properties will be modified
## Benefits
- Enhanced deployment safety: Teams can review all changes before applying them
- Better change management: Complete visibility into infrastructure and identity changes
- Improved CI/CD workflows: What-if checks can be integrated into automated pipelines
- Consistent experience: Unified what-if functionality across all Bicep resource types
## Additional Context
This feature would significantly improve the deployment experience for organizations using Infrastructure as Code for both Azure resources and Microsoft Graph objects, enabling safer and more predictable deployments of identity and access management configurations. We are aware that we also can managed Entra objects using PowerShell or similar, but we want to try to keep infra deployments in one file/language, where possible to reduce complexity.
Contributor guide
Research direction
Start by reviewing the Microsoft Graph Bicep extension's documented unsupported deployment features and the New-AzDeployment and Get-AzDeploymentWhatIfResult entry points. Define and validate what-if behavior for supported Graph resources, including create, modify, delete, and property-level changes for groups, users, applications, and service principals.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, infrastructure
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100