Stage 4 · Provision
Bicep & ARM Templates for Azure
What-If Operations
Preview deployments, confirmation, and safe production changes — seeing the impact before it happens.
What-If Basics
The what-if operation previews what would change in an ARM or Bicep deployment without actually making changes. It is the Azure equivalent of terraform plan. Every deployment should start with what-if.
$ az deployment group what-if \
--resource-group myRG \
--template-file main.bicep
Resource and property changes are shown below.
Microsoft.Storage/storageAccounts/myStorage [Modify]
- properties.minimumTlsVersion: "TLS1_0" => "TLS1_2"
+ properties.supportsHttpsTrafficOnly: true
No resource to delete.
1 resource to modify.
0 resource to delete.The what-if output shows exactly what will change. A minus (-) indicates a property being removed or changed. A plus (+) indicates a new property. The arrow (=>) shows the change from old to new value.
Output Formats
What-if supports multiple output formats for different use cases. JSON format is ideal for programmatic processing in CI pipelines. The table format is human-readable for interactive use.
$ az deployment group what-if \
--resource-group myRG \
--template-file main.bicep \
--result-format full
# JSON output for CI processing
$ az deployment group what-if \
--resource-group myRG \
--template-file main.bicep \
--result-format json > whatif.jsonThe result-format parameter controls output: full shows all properties, json produces machine-readable output. The full format is useful for auditing — it shows every property, not just changes.
Confirmation Mode
The confirmation parameter lets you run what-if as a gate before deployment. If the what-if shows changes, the deployment pauses and waits for confirmation.
$ az deployment group create \
--resource-group myRG \
--template-file main.bicep \
--confirm-with-what-if
# Shows what-if, then prompts:
# Do you want to proceed with the deployment? (y/n)The --confirm-with-what-if flag runs what-if first, displays the changes, and prompts for confirmation. This is ideal for manual deployments where you want to review changes before applying.
CI/CD Integration
steps:
- task: AzureCLI@2
displayName: 'What-If Check'
inputs:
azureSubscription: 'myServiceConnection'
scriptType: 'bash'
scriptLocation: 'inlineScript'
inlineScript: |
az deployment group what-if \
--resource-group $(resourceGroup) \
--template-file $(Build.SourcesDirectory)/main.bicep \
--result-format json > whatif.json
if [ $? -ne 0 ]; then
echo "##vso[task.logissue type=error]What-if failed"
exit 1
fiThe what-if step runs before the actual deployment. If what-if fails or shows unexpected changes, the pipeline stops. The JSON output can be parsed to check for specific change types.
Comparing to Terraform Plan
| Feature | Terraform Plan | ARM What-If |
|---|---|---|
| Output format | Human-readable text | Table or JSON |
| State awareness | Uses state file | Queries Azure for current state |
| Cost estimation | Infracost integration | Azure Cost Management |
| Policy evaluation | OPA/Sentinel at plan time | Azure Policy runs automatically |
| CI gating | Exit code 2 = changes | Exit code 0 = success (regardless of changes) |
Best Practices
- Always run what-if before any deployment to production.
- Use JSON output in CI for programmatic validation.
- Store what-if output as a deployment artifact for audit trail.
- Compare what-if output across environments to catch configuration differences.
- Review resource deletions carefully — what-if shows them prominently.
- Use --confirm-with-what-if for manual deployments.
Unlike terraform plan which reads from state, what-if queries Azure for current resource state. This means it catches drift automatically. The tradeoff is it requires Azure API access and may be slower for large deployments.
What-if shows changes but does not produce an execution plan. It cannot be applied later like a Terraform plan file. The deployment must be re-submitted after reviewing the what-if output.
Mark this lesson complete to store local progress and unlock a cleaner resume path the next time you visit.