3.5 Azure Blueprints, ARM Templates, and Bicep

Quick Answer: ARM templates (JSON) and Bicep (a cleaner DSL that compiles to ARM) define Azure infrastructure as code for repeatable, idempotent deployments. Azure Blueprints bundles policies, roles, and templates, but Azure Blueprints (Preview) will be retired on January 31, 2027, with a phased retirement beginning July 31, 2026; Microsoft recommends migrating to Deployment Stacks and Template Specs.

Infrastructure as Code (IaC)

Infrastructure as Code (IaC) means provisioning and managing infrastructure through machine-readable definition files instead of clicking through portals. The same file deploys the same environment every time.

ARM Templates (JSON)

ARM templates are JSON files that declare the resources to deploy. They are declarative — you state the desired end state and Azure Resource Manager works out the order and the API calls.

Key properties: ARM is idempotent (re-running yields the same result, not duplicates), deploys independent resources in parallel, validates the template before any change, and offers what-if to preview changes.

Bicep

Bicep is Microsoft's domain-specific language (DSL) for Azure. Bicep files (.bicep) transpile (compile) into ARM JSON before deployment, so the runtime is identical — Bicep just makes authoring far easier.

On the Exam: You will NOT write template code. Know that ARM templates are JSON, Bicep compiles to ARM, both are declarative IaC, and both give repeatable deployments.

Azure Blueprints (Retiring January 31, 2027)

Azure Blueprints packages several governance artifacts into one versioned, deployable definition so an entire compliant environment can be stamped out repeatedly. Microsoft says Azure Blueprints (Preview) will be retired on January 31, 2027, with a phased retirement beginning July 31, 2026; migrate blueprint definitions and assignments to Deployment Stacks (recommended) and Template Specs. Blueprints is not in the July 20, 2026 AZ-900 skills outline.

Azure Management Tools Summary

On the Exam: Cloud Shell runs in the browser with no local install and supports both Bash and PowerShell. The first time you start it, you can continue with or without storage; an Azure Storage account (file share) is needed only to persist your files between sessions.

Choosing the Right Tool — A Scenario

A team needs to stand up an identical three-tier web app in dev, test, and production with zero configuration drift. The portal is wrong here because manual clicks are not repeatable; the CLI and PowerShell are imperative scripts that can drift over time. The right answer is declarative IaC: author the resources once in Bicep, store the file in Git, and deploy it through a pipeline to all three environments. Because the deployment is idempotent, re-running it to apply a patch updates only what changed rather than creating duplicates, and what-if previews the impact before anyone commits.

Now suppose the same team must also stamp out, for each new business unit, a resource group plus the policies and role assignments that keep it compliant. Historically that was Azure Blueprints, which packaged all of those artifacts together. With Blueprints retiring on January 31, 2027, the team should instead store the templates as Template Specs and deploy them through Deployment Stacks, using the stack's deny settings to protect the deployed resources the way Blueprint locks used to.

Common Traps

• ARM is JSON, Bicep is a DSL that compiles to ARM — they are not rivals, Bicep sits on top of ARM.
• Terraform is third-party and multi-cloud; ARM and Bicep are Azure-native.
• Blueprints is being retired — if a question offers it as a new recommendation, prefer Template Specs and Deployment Stacks.
• Cloud Shell storage is optional: without a storage account, files don't persist between sessions.