azure-validate

Run pre-deployment validation that checks azure.yaml schema, authentication, subscription and location settings, then executes azd provision --preview and azd package to confirm everything succeeds. All checks must pass and proof is recorded in the deployment plan before deploying.

Compile with az bicep build, validate with az deployment sub validate or az deployment group validate, and preview changes with az deployment what-if. Optionally run az bicep lint and check Azure Policy compliance for your subscription.

Generic roles like Contributor or Reader do not include data-plane access, so a managed identity cannot read blobs or secrets without roles like Storage Blob Data Contributor or Key Vault Secrets User. Statically review role assignments in your Bicep or Terraform to confirm each identity has correct least-privilege data-plane roles.

Yes, separate validation recipes exist for AZD, Azure CLI, Bicep, and Terraform projects. The Terraform recipe covers init, fmt, validate, plan, state backend checks, and detection of unsupported Go-style template variables in main.tfvars.json.

When Aspire configures identity-based storage via WithHostStorage, the Functions runtime cannot store secrets in blob storage using URI-based settings. Add .WithEnvironment("AzureWebJobsSecretStorageType", "Files") to the Functions project builder chain before provisioning.

Do not deploy if any validation check fails, if azd provision --preview reports unsupported resource types, or if Azure Policy violations remain unresolved. Fix the issues, re-run validation, and only set the plan status to Validated after all checks pass with recorded proof.