From ARM templates to Bicep

Make a folder for this lesson’s files:

New-Item -ItemType Directory -Path C:\azure-lab\bicep -Force | Out-Null
Set-Location C:\azure-lab\bicep

1Create an NSG by hand, the “click-ops” way

Run this:

az group create --name rg-saat-l41 --location centralindia --tags course=saatvedha-azure lesson=41 -o none
az network nsg create --resource-group rg-saat-l41 --name nsg-saat-demo --tags course=saatvedha-azure lesson=41 -o none
az network nsg rule create --resource-group rg-saat-l41 --nsg-name nsg-saat-demo --name allow-https-in --priority 100 --direction Inbound --access Allow --protocol Tcp --source-address-prefixes Internet --destination-port-ranges 443 -o none

2Export it as an ARM template

Run this, then open exported.json in VS Code:

az group export --name rg-saat-l41 > exported.json
(Get-Content exported.json).Count

You should see a number around 70: the line count of the exported JSON.

Look at what you got: a parameter called networkSecurityGroups_nsg_saat_demo_name, the region hard-coded, the rule written twice (inside the NSG and again as a separate resource), and dependsOn by hand. That’s typical of exported templates.

3Write the clean Bicep version

Save this as nsg.bicep (in VS Code, or with the here-string below), then build it:

$b = @'
@description('Name of the network security group')
param nsgName string = 'nsg-saat-demo'

@description('Azure region for the NSG')
param location string = resourceGroup().location

@description('Priority of the HTTPS rule (100 to 4096)')
@minValue(100)
@maxValue(4096)
param httpsPriority int = 100

resource nsg 'Microsoft.Network/networkSecurityGroups@2024-05-01' = {
  name: nsgName
  location: location
  tags: {
    course: 'saatvedha-azure'
    lesson: '41'
  }
  properties: {
    securityRules: [
      {
        name: 'allow-https-in'
        properties: {
          protocol: 'Tcp'
          sourcePortRange: '*'
          destinationPortRange: '443'
          sourceAddressPrefix: 'Internet'
          destinationAddressPrefix: '*'
          access: 'Allow'
          priority: httpsPriority
          direction: 'Inbound'
        }
      }
    ]
  }
}

output nsgId string = nsg.id
'@
Set-Content -Path nsg.bicep -Value $b
az bicep build --file nsg.bicep
(Get-Content nsg.bicep).Count

You should see this, and a new nsg.json next to it:

38

No output from the build means no errors and no warnings. 38 lines of Bicep compile to the same kind of JSON that took about 70 lines to export, and this version has a region parameter, a validated priority and an output.

4Deploy it with a parameters file

Create a .bicepparam file that changes the priority, and deploy:

Set-Content -Path nsg.bicepparam -Value "using 'nsg.bicep'`n`nparam httpsPriority = 200"
az deployment group create --resource-group rg-saat-l41 --name nsg-deploy --parameters nsg.bicepparam --query "{state:properties.provisioningState, nsgId:properties.outputs.nsgId.value}" -o yaml
az network nsg rule list --resource-group rg-saat-l41 --nsg-name nsg-saat-demo --query "[].{name:name, priority:priority, port:destinationPortRange}" -o table

You should see something like this:

nsgId: /subscriptions/.../resourceGroups/rg-saat-l41/providers/Microsoft.Network/networkSecurityGroups/nsg-saat-demo
state: Succeeded
Name            Priority    Port
--------------  ----------  ------
allow-https-in  200         443

The deployment updated the NSG you created by hand: same name, so Resource Manager changed the rule’s priority instead of creating a second NSG. From now on, this file is the source of truth.

5Deploy again and see nothing change

Run the same deployment a second time:

az deployment group create --resource-group rg-saat-l41 --name nsg-deploy-2 --parameters nsg.bicepparam --query "properties.provisioningState" -o tsv

You should see this:

Succeeded

Same file, same result, no changes. Lesson 42 adds what-if, which shows you that before you deploy.

One more habit for every ARM template to Bicep conversion: read the warnings, not just the errors. If you misspell a property, for example secrityRules instead of securityRules, Bicep still builds and prints Warning BCP089: The property "secrityRules" is not allowed on objects of type "NetworkSecurityGroupPropertiesFormat". Did you mean "securityRules"?

A warning doesn’t stop the build, so a pipeline carries on, and depending on how the resource provider treats unknown properties, you can end up with an NSG without the rules you meant to add. Make your pipeline fail on any Bicep warning, and fix them in VS Code, where they show as yellow squiggles while you type.

✅ Checkpoint: nsg.bicep builds with no warnings, deploys with nsg.bicepparam, and the rule now has priority 200.