Encountered internal server error while processing the deployment what-if request

[scrocquesel-ml150]

Describe the bug

I am trying to run az deploy what-if and keep getting InternalServerError as output

Related command

none

Errors

$ az deployment group what-if --resource-group test --template-file solution.bicep 
InternalServerError - Encountered internal server error while processing the deployment what-if request. Diagnostic information: timestamp '20250730T145310Z', scope '/subscriptions/71236681-3afb-467d-aca8-613d6681ab28/resourceGroups/test-scl', tracking id '6883a4df-f349-479a-bf3d-1842b09e1a4c', request correlation id '8d5a9795-84a4-4c58-aa8c-245b11860ee2'.

Issue script & Debug output

N/A: The debug didn't show anything interesting related to the error as the task is executed on Azure

Expected behavior

Should see the expected change output of the what-if command

Environment Summary

$ az version
{
  "azure-cli": "2.75.0",
  "azure-cli-core": "2.75.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "apic-extension": "1.1.0",
    "azure-devops": "1.0.1",
    "azure-iot": "0.25.0",
    "rdbms-connect": "1.0.7",
    "resource-graph": "2.1.1"
  }
}

$ az bicep version
Bicep CLI version 0.36.1 (a727ed087a)

Additional context

I think the error is related to the evaluation of the name of a resource.

Here some snippet of my biceps

// '/subscriptions/[2]/resourceGroups/[4]/providers/Microsoft.Web/serverfarms/[8]'
var applicationPlanResourceIdParts = split(applicationPlanResourceId, '/')
resource serverFarm 'Microsoft.Web/serverfarms@2024-11-01' existing = {
  scope: resourceGroup(applicationPlanResourceIdParts[2], applicationPlanResourceIdParts[4])
  name: applicationPlanResourceIdParts[8]
}

var isWindows = !serverFarm.properties.reserved

module functionApp 'br/public:avm/res/web/site:0.15.0' = {
  name: 'dp-avm-res-web-site-${uniqueString(functionName)}'
  params: {
    // when the name is dynamically resolved from the serverFarm properties, it fails
    name: isWindows ? uniqueString(functionName) : uniqueString(functionName, 'linux')
    // ... other params
}

[yonzhan]

Thank you for opening this issue, we will look into it.

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/deployments-owners.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az deployment group what-if results in ValidationError: InternalServerError  #15402
• Encountered internal server error while processing the deployment what-if request #22314
• Internal Server Error on what-if analysis after upgrading to 2.28.0 from 2.26.0 #19850

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

The support engineer has found what triggers the issue in the what-if engine. We have a parameter like this in our templates:

param tags object = resourceGroup().tags

However, that seems to break what-if when used in modules where we don't pass in the tags from the main template. So the workaround for now is to pass in the tags in all module usages.

Reference:

• Encountered internal server error while processing the deployment what-if request #22314 (comment)

Solution 2:

Found the root cause. This is indeed a bug in the What-If engine. We added normalization process for Azure KeyVault access policies in 2021-01-01, but there's a case we failed to handle. I'm going to fix it.

Reference:

• Internal Server Error on what-if analysis after upgrading to 2.28.0 from 2.26.0 #19850 (comment)

Solution 3:

Just got a confirmation on my support request that the product team has created a fix for the bug and that it will be pushed out in about two weeks.

Reference:

• Encountered internal server error while processing the deployment what-if request #22314 (comment)

Powered by issue-sentinel

[microsoft-github-policy-service]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Azure/deployments-owners.

[scrocquesel-ml150]

I confirm that if I compute the value in a submodule and use its output, it doesn't fail. However, if the module output only the isWindows variable and the module param name is still an expression (mymodule.outputs.isWindows ? ...), it fails too.
The error in this case is InternalServerError - Encountered internal server error while processing the deployment what-if request. Diagnostic information: timestamp '20250730T161219Z', scope '/subscriptions/71236681-3afb-467d-aca8-613d6681ab28/resourceGroups/test-scl', tracking id 'cfcac71a-be7c-446f-a0a4-4fb2b692eaf1', request correlation id '2c5b9655-bb87-4ba6-836f-dad4afb350ed'.

[torreymicrosoft]

Thanks for your patience — this was recently picked up as an outstanding open issue for the ARM Deployments team to review.

scrocquesel-ml150 — thanks for narrowing it down so well back in July: a what-if InternalServerError when a module's value is an expression derived from a runtime read (an existing resource's .properties.reserved, or another module's output).

I re-tested the cross-module-output variant you described on the current what-if engine (Bicep 0.43.8 / CLI 2.85.0):

module consumer './consumer.bicep' = {
  name: 'consumer'
  params: { appName: probe.outputs.isWindows ? uniqueString('win') : uniqueString('linux') }
}

This now completes cleanly — no InternalServerError. The closely-related repro in #31758 (a resource whose name is built from resourceGroup().location) is also clean now, so the broader InternalServerError family looks fixed server-side.

I couldn't reproduce your exact case — reading .properties.reserved off an existing App Service plan — without standing one up, so I'd appreciate your confirmation. Could you re-run your az deployment sub what-if on a current CLI? If it still errors, the correlation ids you already shared (8d5a9795-… and 2c5b9655-…) plus a fresh one will let us pull what-if telemetry. Since it seems it's clean now, we'll close this as resolved. Thanks!