Subscription-scoped Bicep module emits invalid resourceGroup().location in nested deployments, causing deployment failure

[michaeljsaxbury]

When deploying resource groups using a Bicep template at the subscription scope, with a module pattern like:

Using windows-latest build agent via pipeline in Azure Devops, tried bicep build locally with same versions:
Bicep version: (your version, e.g., 0.24.24)
CLI version: (your version, e.g., 2.60.0)
OS: (your OS, e.g., Windows 11)

BICEPPARAM:

param resourceGroups = [
  {
    subscriptionId: 'xxxxx-xxxx-xxxx-xxxxxx'
    subscriptionKey: 'test'
    name: 'test-rg'
    location: 'eastus2' // <-- Location where the resource group will reside in azure
    tags: {
      environment: 'test'
      owner: 'test-team'
    }
  }
]

MAIN BICEP:

module resourceGroupModule '../../../modules/resource-group/resource-group.bicep' = [for rg in resourceGroups: {
  name: 'rg_${rg.name}'
  scope: subscription(rg.subscriptionId)
  params: {
    rgConfig: rg
  }
}]

Running the deployment with azure cli on windows-latest build agent:
az deployment sub create --location eastus --template-file main.bicep --parameters ...

The generated ARM template for the nested deployment contains JSON:

  "resources": [
    {
      "copy": {
        "name": "resourceGroupModule",
        "count": "[length(parameters('resourceGroups'))]"
      },
      "type": "Microsoft.Resources/deployments",
      "apiVersion": "2025-04-01",
      "name": "[format('rg_{0}', parameters('resourceGroups')[copyIndex()].rgName)]",
      "subscriptionId": "[parameters('resourceGroups')[copyIndex()].subscriptionId]",
      **"location": "[resourceGroup().location]",**
      "properties": {

This results in the error:
ERROR: The target scope "resourceGroup" does not match the deployment scope "subscription".
or resourceGroup().location is not valid at the subscription scope

Expected Behavior:
The Bicep compiler should emit a valid Azure region string for the location property of the nested deployment (e.g., "location": "eastus2", or from the resource group object), not resourceGroup().location.
It should be possible to specify the deployment location for each nested deployment at the subscription scope, even when using a module.

I tried setting --location 'eastus' for the deployment on the az command but get the same error

Actual Behavior:
The location property for the nested Microsoft.Resources/deployments resource is set to resourceGroup().location, which is invalid at subscription scope.
This causes deployments to fail unless the user manually builds the ARM template and patches the location property.

Steps to Reproduce:
Create a Bicep template as shown above, with a resource group module and an array of resourceGroups.
Deploy using az deployment sub create.
Observe the generated ARM template contains "location": "[resourceGroup().location]".
Deployment fails with an error.

Workaround:
Manually build the Bicep file to JSON.
Edit the generated template to set a valid Azure region for all Microsoft.Resources/deployments resources.
Deploy the JSON template instead of the Bicep file.

Related Issues:
#10151 says it was fixed in version [ 0.22.0+ ]
Azure/bicep#4967
Azure/bicep#12156

[jeskew]

I believe the issue is that main.bicep is compiling as a resource-group scoped template. Bicep templates are resource group-scoped by default; you can override this behavior by setting targetScope = 'subscription' in the main.bicep file.

Because ../../../modules/resource-group/resource-group.bicep has targetScope = 'subscription' set, Bicep recognizes that the module will be deployed at subscription scope and therefore has to provide a location property. Since one was not explicitly supplied, Bicep uses the location of the parent template, which is expressed as [resourceGroup().location] in resource group-scoped templates and as [deployment().location] otherwise.