az bicep snapshot generates unique strings every run

[frits-becker]

Describe the bug

az bicep snapshot has been introduced in 2.88.0

We have tried to migrate from "bicep snapshot" to "az bicep snapshot", but it does not work, because the function uniqueString will be run.

Below one of our examples

bicep snapshot:
"linkedResourceId": "[reference(resourceId('00000000-0000-0000-0000-000000000000', 'rg-snapshot-fnd-euwe-001', 'Microsoft.Resources/deployments', format('logAnalyticsWorkspace-{0}', uniqueString('logAnalyticsWorkspace', format('analyticsWorkspace-{0}', uniqueString('analyticsWorkspace', format('analyticsWorkspace-{0}', uniqueString('analyticsWorkspace', format('privatelink-{0}', uniqueString('privatelink', format('analyticsWorkspace-{0}', uniqueString('analyticsWorkspace', deployment().name))))))))))), '2025-04-01').outputs.resourceId.value]"

az bicep snapshot:
"linkedResourceId": "[reference('/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-snapshot-fnd-euwe-001/providers/Microsoft.Resources/deployments/logAnalyticsWorkspace-3ey2hd7rftyqo', '2025-04-01').outputs.resourceId.value]"

Related command

az bicep snapshot

Errors

Snapshot validation failed. Expected no changes, but found the following:

Issue script & Debug output

az bicep snapshot --file $paramFile
--subscription-id $subscriptionId --location 'westeurope'
--mode $mode

Expected behavior

snapshot overwrite and validate should always generate the same json.

Environment Summary

azure-cli 2.89.1

core 2.89.1
telemetry 1.1.0

Extensions:
acrcssc 1.0.0b7
azure-devops 1.0.6

Dependencies:
msal 1.36.0
azure-mgmt-resource 24.0.0

Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\frits.azure'
Extensions directory 'C:\Users\frits.azure\cliextensions'

Python (Windows) 3.14.6 (tags/v3.14.6:c63aec6, Jun 10 2026, 10:26:10) [MSC v.1944 64 bit (AMD64)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[frits-becker]

Just to be clear. the "3ey2hd7rftyqo" in the linkedResourceId is what changes every run in this example

[x-engineering-agent]

Bug Analysis

az bicep snapshot is implemented in src/azure-cli/azure/cli/command_modules/resource/custom.py
(see snapshot_bicep_file and the code path that builds linkedResourceId references for nested
deployments). The reporter shows that when migrating from the standalone bicep snapshot CLI to
az bicep snapshot, the generated ARM template JSON embeds a resolved deployment resource ID
(e.g. .../deployments/logAnalyticsWorkspace-3ey2hd7rftyqo) instead of preserving the original
reference(resourceId(...), format(..., uniqueString(...))) expression. Because uniqueString(...)
is evaluated eagerly by az bicep snapshot (rather than left as a template expression the way the
standalone bicep CLI keeps it), each snapshot run produces a different resolved suffix, causing
--mode Validate to always report an unexpected diff.

Root cause (likely): the snapshot/Overwrite code path in resource/custom.py is calling into
Bicep in a mode that fully evaluates nested-template functions like uniqueString and
deployment().name, embedding the resolved (non-deterministic) resource ID string in the linked
template reference, instead of preserving the unresolved ARM template expression as bicep's
standalone snapshot command does.

Suggested fix: compare how the standalone Bicep CLI's snapshot command invokes the compiler
versus az bicep snapshot's invocation in custom.py, and ensure the CLI passes through whatever
flag/behavior keeps uniqueString/reference/resourceId as unresolved template functions rather
than eagerly resolving them into literal values. Add/adjust a regression test in
test_resource_bicep.py that runs az bicep snapshot --mode Overwrite twice on a .bicepparam file
containing nested uniqueString(...) calls and asserts the snapshot content is byte-identical across
runs (and equivalent to the reference from the standalone bicep snapshot output).

Use this EXACT PR title: [Resource] Fix #33921: az bicep snapshot: Preserve linked resource ID format in bicepparam snapshot to avoid nondeterministic uniqueString regeneration

PR title & description format (required)

This repo enforces a PR format (guide). Please author the PR exactly as follows or CI's Check the Format of Pull Request Title and Content will fail.

Use this EXACT PR title (copy verbatim, do not reword):

[Resource] Fix #33921: `az bicep snapshot`: Preserve linked resource ID format in bicepparam snapshot to avoid nondeterministic uniqueString regeneration

Keep the backticks around the command and the Fix #33921: prefix. You may only adjust the wording after the command (the final summary) if the fix changes; the [Resource] prefix, issue link, and backticked command must stay.

Description — follow the PR template and fill in:

• Link the issue — start the Description with a closing keyword so the PR auto-links and closes it: Fixes #33921.
• Related command — the az ... command this affects.
• Description (mandatory) — why the bug happens, what you changed, and the resulting behavior.
• Testing Guide — example command(s) showing the fix works.
• History Notes — leave the title to drive the history note, or add extra lines in the same format (component in brackets + the command in backticks), e.g. [Resource] `az <command>`: <note>.
• Keep the template checklist and tick the items you've satisfied.

---

Posted by agent-assist (autonomous bug-fix pipeline).