az bicep lint fails when running AzureCLI@2 task in Azure DevOps pipeline

[dozer75]

I have a Azure DevOps pipeline task that is linting my bicep file, but suddenly for SOME resources it fails claiming that the version of the resource doesn't have any types available (e.g. Resource type "Microsoft.Network/networkInterfaces@2024-10-01" does not have types available. Bicep is unable to validate resource properties prior to deployment, but this will not block the resource from being deployed. [https://aka.ms/bicep/core-diagnostics#BCP081]).

For now it fails on:

• Microsoft.Network/networkInterfaces@2024-10-01
• Microsoft.Network/networkSecurityGroups@2024-10-01

It works for other resource types with newer version than these, but not for these... It also works if I run linting locally.

I realize that the version of both az cli and the bicep extension is old (but not that old, see below for version), so I can't see that they should be the problem. I have tried to upgrade both, the az cli is upgraded, however when trying to run az bicep upgrade the latest version is NOT applied.

Az CLI version info:

{
  "azure-cli": "2.78.0",
  "azure-cli-core": "2.78.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "azure-devops": "1.0.2"
  }
}

Bicep CLI version 0.37.4 (27cc8db) (should after the upgrade be upgraded to 0.38.33 (6bb5d5f859))

This are the task I'm trying to execute for upgrade:

  - task: AzureCLI@2
    inputs:
      azureSubscription: ${{ parameters.AZURE_SERVICE_CONNECTION }}
      scriptType: bash
      scriptLocation: inlineScript
      inlineScript: |
        az version
        az bicep version

        az upgrade --yes
        az bicep upgrade --debug

        az version
        az bicep version
    displayName: Ensure latest Azure CLI and Bicep versions

This is the bicep it tries (and fails) for linting:
NSG:

resource nsg 'Microsoft.Network/networkSecurityGroups@2024-10-01' existing = {
  name: 'nsg-default-${environment}'
}

NIC:

resource nic 'Microsoft.Network/networkInterfaces@2024-10-01' existing = {
  name: 'nic-pe-sql-${environment}'
}

Not any strange resources. Worth noting is that they uses existing...

SO, the questions are:

1. Why isn't the bicep upgraded?
2. Why do I get the linting error on these resources even with the 0.37.4 bicep version which came in august?

For now, I will downgrade the versions for these, but it is interesting to know why this happens and how to solve it.

For reference, here is the az bicep upgrade --debug output if that's any help analyzing:

DEBUG: cli.knack.cli: Command arguments: ['bicep', 'upgrade', '--debug']
DEBUG: cli.knack.cli: __init__ debug log:
Cannot enable color.
DEBUG: cli.knack.cli: Event: Cli.PreExecute []
DEBUG: cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x7fc296424fe0>, <function OutputProducer.on_global_arguments at 0x7fc2961a8cc0>, <function CLIQuery.on_global_arguments at 0x7fc2961d2de0>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
DEBUG: cli.azure.cli.core: Modules found from index for 'bicep': ['azure.cli.command_modules.resource']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands
DEBUG: cli.azure.cli.core: resource                  0.154        52       234
DEBUG: cli.azure.cli.core: Total (1)                 0.154        52       234
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
DEBUG: cli.azure.cli.core: Total (0)                 0.000         0         0  
DEBUG: cli.azure.cli.core: Loaded 52 groups, 234 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command  : bicep upgrade
DEBUG: cli.azure.cli.core: Command table: bicep upgrade
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x7fc2953522a0>]
DEBUG: cli.azure.cli.core.azlogging: metadata file logging enabled - writing logs to '/home/vsts/work/_temp/.azclitask/commands/2025-10-21.07-58-39.bicep_upgrade.2606.log'.
INFO: az_command_data_logger: command args: bicep upgrade --debug
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x7fc295393560>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x7fc2953b58a0>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x7fc2953b5a80>, <function register_upcoming_breaking_change_info.<locals>.update_breaking_change_info at 0x7fc2953b5b20>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
DEBUG: cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x7fc2961a8d60>, <function CLIQuery.handle_query_parameter at 0x7fc2961d2e80>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x7fc2953b5940>]
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): aka.ms:443
DEBUG: urllib3.connectionpool: [https://aka.ms:443](https://aka.ms/) "GET /BicepLatestRelease HTTP/1.1" 301 0
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): downloads.bicep.azure.com:443
DEBUG: urllib3.connectionpool: [https://downloads.bicep.azure.com:443](https://downloads.bicep.azure.com/) "GET /releases/latest HTTP/1.1" 200 54506
DEBUG: cli.azure.cli.command_modules.resource._bicep: Current value of "use_binary_from_path": if_found_in_ci.
DEBUG: cli.azure.cli.command_modules.resource._bicep: Running in a CI environment. Bicep CLI available on PATH: True.
DEBUG: cli.knack.cli: Event: CommandInvoker.OnTransformResult [<function _resource_group_transform at 0x7fc295392e80>, <function _x509_from_base64_to_hex_transform at 0x7fc295392f20>]
DEBUG: cli.knack.cli: Event: CommandInvoker.OnFilterResult []
DEBUG: cli.knack.cli: Event: Cli.SuccessfulExecute []
DEBUG: cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x7fc295352520>]
INFO: az_command_data_logger: exit code: 0
INFO: cli.__main__: Command ran in 0.496 seconds (init: 0.162, invoke: 0.334)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1

[anthony-c-martin]

I think you might be running into this bug: Azure/azure-cli#32098

As a workaround, could you try running the following before running az bicep upgrade:

az config set bicep.use_binary_from_path=false

[dozer75]

Thanks, it worked and upgrading the bicep version solved my other issue with resource versions missing... Maybe the AzureCLI@2 task should be updated with the latest Azure CLI and bicep packages?