Azure "az deployment group create" Bicep Deploy Fails in CI

By Daniel Zoghalchali·Latchkey

Azure rejected your Bicep/ARM deployment. Either the Bicep failed to compile (a BCP error), the template was invalid for the resource, or the deploying identity lacked permission to create or modify the resources.

What this error means

az deployment group create fails with a BCPxxxx compile error, an InvalidTemplateDeployment, or AuthorizationFailed. Compile and validation errors reproduce every run; an auth error fails until the identity gets the role. Use --what-if to preview before applying.

az output

ERROR: {"code": "InvalidTemplateDeployment", "message": "The template deployment
failed with error: 'Authorization failed for ... to perform action
'Microsoft.Storage/storageAccounts/write'."}

Common causes

Bicep compile or template validation error

A BCPxxxx error means the Bicep does not compile; an InvalidTemplateDeployment means the resulting ARM template is invalid for the target - a bad property, SKU, or location.

Authorization failed for the deploying identity

The service principal or managed identity running the deploy lacks the RBAC role (e.g. Contributor) on the resource group, so resource writes are denied.

How to fix it

Validate and what-if before applying

Build the Bicep and run a what-if so template and validation errors surface without changing anything.

Terminal

az bicep build --file main.bicep
az deployment group what-if -g my-rg --template-file main.bicep

Grant the deploy identity the right role

Assign an RBAC role scoped to the resource group so the identity can create the resources.

Terminal

az role assignment create \
  --assignee <sp-or-mi-object-id> \
  --role "Contributor" \
  --scope /subscriptions/<sub>/resourceGroups/my-rg

How to prevent it

Run az bicep build and what-if in PR checks before deploy.
Scope an RBAC role to the deploy identity at the resource-group level up front.
Pin the Bicep CLI version so compile behavior is stable.

Frequently asked questions

What causes ""deployment group create" failed"?

A BCPxxxx error means the Bicep does not compile; an InvalidTemplateDeployment means the resulting ARM template is invalid for the target - a bad property, SKU, or location.

How do I fix "deployment group create" failed?