Deployment failures: RequestDisallowedByPolicy and Bicep errors

Keep the resource group for both breaks.

1Break it: a typo Bicep catches

Someone edits the port line and mistypes the parameter name. Change string(appPort) to string(appPortt), then deploy:

(Get-Content C:\azure-lab\l67\main.bicep -Raw) -replace 'string\(appPort\)', 'string(appPortt)' | Set-Content C:\azure-lab\l67\main.bicep
az deployment group create --resource-group rg-saat-l67 --name d67 --template-file C:\azure-lab\l67\main.bicep -o none

You’ll get output like this:

C:\azure-lab\l67\main.bicep(5,7) : Warning no-unused-params: Parameter "appPort" is declared but never used. [https://aka.ms/bicep/linter-diagnostics#no-unused-params]
C:\azure-lab\l67\main.bicep(22,40) : Error BCP057: The name "appPortt" does not exist in the current context. [https://aka.ms/bicep/core-diagnostics#BCP057]

Nothing reached Azure. The error gives file, line, column and a code, and the warning above it is a strong hint: the real parameter is now unused. This is the cheapest kind of failure; run az bicep build in your pipeline before every deployment to catch it there.

Fix it: correct the name and build again:

(Get-Content C:\azure-lab\l67\main.bicep -Raw) -replace 'appPortt', 'appPort' | Set-Content C:\azure-lab\l67\main.bicep
az bicep build --file C:\azure-lab\l67\main.bicep --stdout | Out-Null

No errors or warnings are printed.

2Break it: a value Azure rejects

A colleague moves the rule “to the end of the list” by giving it priority 5000. Bicep doesn’t know the allowed range, so the build passes:

(Get-Content C:\azure-lab\l67\main.bicep -Raw) -replace 'priority: 200', 'priority: 5000' | Set-Content C:\azure-lab\l67\main.bicep
az deployment group create --resource-group rg-saat-l67 --name d67 --template-file C:\azure-lab\l67\main.bicep -o none

You’ll get an error like this:

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/.../deployments/d67","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[...]}}

DeploymentFailed tells you only that something failed. Ask which operation failed and why:

az deployment operation group list --resource-group rg-saat-l67 --name d67 --query "[?properties.provisioningState=='Failed'].{resource:properties.targetResource.resourceName, code:properties.statusMessage.error.code, message:properties.statusMessage.error.message}" -o json

You should see something like this:

[
  {
    "code": "SecurityRuleInvalidPriority",
    "message": "Security rule has invalid Priority. Value provided: 5000 Allowed range 100-4096.",
    "resource": "nsg-app67"
  }
]

The real error is on nsg-app67: NSG priorities must be between 100 and 4096. rt-app67 isn’t in the list because it didn’t fail.

Fix it: use a valid priority, and redeploy with the same name:

(Get-Content C:\azure-lab\l67\main.bicep -Raw) -replace 'priority: 5000', 'priority: 4000' | Set-Content C:\azure-lab\l67\main.bicep
az deployment group create --resource-group rg-saat-l67 --name d67 --template-file C:\azure-lab\l67\main.bicep --query properties.provisioningState -o tsv

You should see Succeeded.

To stop this kind of mistake earlier, add a decorator to the parameter or a check in your module, for example @minValue(100) and @maxValue(4096) on a priority parameter. Then Bicep refuses the value before anything is sent.

Policy failures behave differently from this one. A RequestDisallowedByPolicy error comes back during validation, before any resource is created, and the deployment has no failed resource operations to read. The error itself names the policy assignment, as you saw in Lesson 54. If your pipeline reports a failure with no failed operations, look for a policy or quota message in the deployment’s own error first.

3Clean up

Delete the lab resource group:

az group delete --name rg-saat-l67 --yes

✅ Checkpoint: You stopped a compile error before Azure and found a deploy-time error in the deployment operations.