Bicep What-If Preview

The what-if operation shows what a deployment would change before it changes anything. Azure compares the Bicep file with the live resources and prints a report of additions, edits, and deletions. Nothing in the cloud moves during the preview.

Think of a dress rehearsal before opening night. Actors run the whole play, and the director spots problems while the audience is still outside. A what-if run gives the same safety to infrastructure changes.

Where What-If Fits in the Workflow

  Edit Bicep file
        │
        ▼
  Run what-if  ──── report looks wrong ───► Fix the file
        │
        │ report looks right
        ▼
  Deploy for real

Run a What-If Preview

The command mirrors the normal deployment command and swaps create for what-if.

az deployment group what-if \
  --resource-group rg-shop-dev \
  --template-file main.bicep \
  --parameters dev.bicepparam

PowerShell users add the -WhatIf switch to the deployment cmdlet.

New-AzResourceGroupDeployment `
  -ResourceGroupName rg-shop-dev `
  -TemplateFile main.bicep `
  -WhatIf

Reading the Report

Each line begins with a symbol that describes the planned action.

Symbol	Change Type	Meaning
+	Create	The resource does not exist and will be built
-	Delete	The resource exists and will be removed
~	Modify	The resource exists and its properties will change
=	NoChange	The resource already matches the file
*	Ignore	The resource exists and the deployment will not touch it
!	Deploy	The outcome depends on values known only at deployment time

Sample Output

Resource and property changes are indicated with these symbols:
  + Create
  ~ Modify
  = Nochange

  + Microsoft.Storage/storageAccounts/stshopdata001
  ~ Microsoft.Web/serverfarms/asp-shop
      ~ sku.name: "B1" => "P1v3"
  = Microsoft.Web/sites/app-shop-001

Resource changes: 1 to create, 1 to modify, 1 no change.

The report says Azure would build a storage account, upgrade the plan size from B1 to P1v3, and leave the web app alone. A surprise in this list, such as an unexpected delete, signals a mistake in the file.

Confirm Before Deploying

The --confirm-with-what-if switch combines both steps. Azure shows the report and asks for a yes or no before it proceeds.

az deployment group create \
  --resource-group rg-shop-dev \
  --template-file main.bicep \
  --confirm-with-what-if

Watch for Delete Lines

Incremental mode, the default, keeps resources that the file does not mention. Complete mode removes them. A what-if run in complete mode lists every planned delete, which makes it a vital check before anyone uses that mode.

What-If in Pipelines

Many teams run what-if automatically on every pull request. Reviewers read the report beside the code change, and an approval step guards the real deployment. The habit catches problems while they are cheap to fix.

Limits of the Preview

What-if predicts results from the information available at preview time. Values calculated during deployment, such as generated keys, appear as unknown. Some reports include harmless noise, where a property seems to change but the live value stays equal. Treat the report as a strong guide rather than a guarantee.

Summary

The what-if preview compares a Bicep file with live resources and lists planned creates, modifies, and deletes without changing anything. Symbols mark each action, and --confirm-with-what-if adds a pause before deployment. Teams run what-if in pull requests and before complete-mode deployments to prevent unwanted changes.