Bicep Template Specs

A template spec is a versioned template stored inside Azure as a resource. Teams publish approved infrastructure designs once, and other people deploy them by name. Access follows normal Azure role rules, so a company controls who may read or use each spec.

Imagine an architect's archive. The architect files approved house plans in a locked cabinet with version labels. Builders request a plan by name and receive a copy, and nobody edits the original.

Spec Flow

  Author                    Azure                         Deployer
 ┌──────────────┐ publish  ┌────────────────────┐ deploy  ┌────────────┐
 │ main.bicep   │ ───────► │ Template spec      │ ──────► │ Resource   │
 └──────────────┘          │  version 1.0       │         │ group      │
                           │  version 2.0       │         └────────────┘
                           └────────────────────┘

Publish a Template Spec

The az ts create command compiles the Bicep file and stores the result as a spec version.

az ts create \
  --name storageSpec \
  --version 1.0 \
  --resource-group rg-specs \
  --location eastus \
  --template-file main.bicep

Publishing again with version 2.0 keeps the older version available.

Deploy from a Template Spec

Look up the version ID and pass it to the deployment command.

id=$(az ts show \
  --name storageSpec \
  --version 1.0 \
  --resource-group rg-specs \
  --query "id" --output tsv)

az deployment group create \
  --resource-group rg-shop-dev \
  --template-spec $id

Use a Template Spec as a Module

A Bicep file can call a spec with the ts: prefix. The format names the subscription, resource group, spec, and version.

module storage 'ts:00000000-0000-0000-0000-000000000000/rg-specs/storageSpec:1.0' = {
  name: 'storageDeploy'
  params: {
    storageName: 'stshopdata001'
  }
}

Control Who Can Use a Spec

Azure role assignments govern specs. A reader on the spec can deploy it, and only authors with write rights can publish new versions. A user may deploy a spec into a resource group without any access to the spec's source repository.

Template Specs vs Module Registry

Feature	Template Spec	Module Registry
Storage location	Azure resource group	Azure Container Registry
Stored format	Compiled ARM JSON	Bicep module package
Access control	Azure RBAC on the spec	Registry permissions
Best for	Complete, ready-to-run deployments	Small building blocks reused inside other files

Good Uses

Self-Service Environments

A platform team publishes an approved web application design. Developers deploy it with their own names and sizes and skip the setup details.

Portal Deployment

The Azure portal offers a guided form that starts a spec as well. People who avoid the command line still deploy approved designs.

Versioning Habits

Publish every change as a new version number. Record the change in a short description on the version. Retire old versions through a documented process so teams know when to move on.

Template Specs in a Company Setting

Large organizations keep specs in a dedicated resource group that few people can edit. Platform engineers publish, and application teams only read and deploy. Security reviewers inspect one stored version instead of many scattered copies. Audit trails show who published each version and when, which supports change-control rules.

Summary

A template spec stores a compiled, versioned template inside Azure. Authors publish with az ts create, and deployers use the version ID or the ts: module address. Azure roles control access, and specs complement module registries by serving complete deployments.