Bicep: Infrastructure Automation Ledger 2026 Scorecard

Part of the Infrastructure Automation Ledger (edition 2026-10-16). How the scores work: methodology.

Snapshot

Type: product (open-source compiler plus the Azure Resource Manager service it targets)
Owner: Microsoft Corporation (United States); built in house
Engine: Compiles to Azure Resource Manager (ARM) JSON templates; Azure Resource Manager is the deployment engine
Licence: MIT, no charge; Microsoft Support covers released features, experimental features are excluded
Latest release: 0.48.1 (2026-10-05); ten minor versions since 2025-11
Support lifecycle: No versioned support windows; you run the current CLI; still versioned 0.x with breaking changes in minor versions
Next milestone: none published
Targets: Azure. vSphere through Azure Arc-enabled VMware vSphere (vCenter Server 8, up to 9,500 VMs per resource bridge) and Hyper-V through Arc-enabled System Center VMM (VMM 2019, 2022 and 2025; retires September 2029) or Azure Local, all needing an Arc resource bridge and a connection to Azure. Kubernetes extension in preview. No Proxmox VE, Nutanix, XCP-ng or KubeVirt target
Tier: Single-cloud reference
Archetype: Dependable builder
Evidence grade: B. GitHub release notes since 0.38 and the Microsoft Learn pages for Bicep, deployment stacks, the MCP server and Azure Arc were read from primary sources. The years of the 2020 to 2025 release tags are inferred from the release sequence, the Arc-enabled vSphere GA date was not read, and partner terms were not read.

Scope of the scores: Single-cloud reference point. Bicep provisions only Azure and reaches vSphere and Azure Local only through Azure Arc, so the provisioning breadth and bare metal domains score low by design and the hardware and cloud coupling criterion scores high. It is included as the comparison point for an IaC language without a state file; it is no hybrid contender.

Scorecard

Dimension	Score	Direction
Capability today	55.8 / 100	higher is better
Momentum since end of 2022	+11.2 points (2021 to 2022: +1.8)	higher is better
Credibility	17.5 / 25	higher is better
Commercial risk	3.0 / 25	lower is better
Technical lock-in	15.0 / 25	lower is better
Integrator fit	16.0 / 20	higher is better
AI leverage	5.0 / 20	higher is better
Ledger Index	59.6 / 100	balanced weights; see the methodology

Capability by domain, 2015 to today

Scores 0 to 5 against fixed anchors; total is weighted to 100.

Domain (weight)	2015	2019	2022	Today
Provisioning breadth (15)	n/a	n/a	2	2.5
Configuration management depth (12)	n/a	n/a	1	1
State, planning and safety (12)	n/a	n/a	2.5	3.5
Language and authoring (10)	n/a	n/a	3.5	4
Orchestration and self-service (10)	n/a	n/a	2.5	3
Scale and control plane (8)	n/a	n/a	3	3.5
Security and compliance (10)	n/a	n/a	3.5	4
Bare metal and day-2 operations (8)	n/a	n/a	0.5	0.5
Ecosystem and integrations (8)	n/a	n/a	3.5	3.5
AI assistance (7)	n/a	n/a	0	2.5
Total / 100	n/a	n/a	44.6	55.8

Year by year: 2021: 42.8 · 2022: 44.6 · 2023: 44.6 · 2024: 51.1 · 2025: 52.5 · 2026: 55.8

What moved the score

Year	Domain	Change	Points	Trigger
2022	Ecosystem and integrations	3 → 3.5	+0.8	0.5.6: public module registry
2022	Language and authoring	3 → 3.5	+1.0	0.5.6: public module registry; decompile command
2024	Language and authoring	3.5 → 4	+1.0	0.25.3 and 0.26.54: compile-time imports and user-defined functions GA
2024	Orchestration and self-service	2.5 → 3	+1.0	Deployment stacks at subscription and management group scope; template specs
2024	Provisioning breadth	2 → 2.5	+1.5	Arc-enabled vSphere and SCVMM VMs manageable from Bicep; Microsoft Graph extension (preview, 0.28.1)
2024	Scale and control plane	3 → 3.5	+0.8	Deployment stacks at management group scope
2024	Security and compliance	3.5 → 4	+1.0	Deployment stacks deny settings
2024	State, planning and safety	2.5 → 3	+1.2	Deployment stacks GA (2024-05-30): managed resource list, deny settings
2025	AI assistance	0 → 1	+1.4	0.37.4: experimental MCP server
2026	AI assistance	1 → 2.5	+2.1	0.40.2: MCP server with ten tools in the VS Code extension and as a NuGet package; local, no deploy, not labelled GA
2026	State, planning and safety	3 → 3.5	+1.2	0.41.2: snapshot command GA

Direction, 2023 to 2026

Each release item carries one theme and one driver (V vision, C customer need, M market window, U upstream, P portfolio).

Date	Item	Theme	Driver
2023-01	0.14.6: paste as Bicep, tuple types, new linter rule	Language	C
2023-06	0.18.4: .bicepparam parameter files	Language	C
2023-09	0.21.1: user-defined types leave experimental	Language	C
2024-02	0.25.3: compile-time imports GA	Language	C
2024-03	0.26.54: user-defined functions GA	Language	C
2024-05	Deployment stacks GA: managed resource list, deny settings, unmanage actions	State and planning	V
2024-06	0.28.1: Microsoft Graph extension public preview	Provisioning breadth	C
2024-07	0.29.45: experimental local deploy and extension model	Provisioning breadth	V
2025-03	0.34.44: language version 2.0 for dependencies on existing resources	Language	C
2025-05	0.36.1: experimental snapshot command; optional variable types GA	State and planning	C
2025-08	0.37.4: experimental MCP server	AI	V
2025-10	0.38.3: onlyIfNotExists GA; experimental console and deploy commands	Language	C
2026-01	0.40.2: MCP server with ten tools bundled in the VS Code extension; move to .NET 10	AI	V
2026-02	0.41.2: snapshot command GA; extension namespace functions	State and planning	C
2026-04	0.42.1: bicep console GA; old visualizer deprecation notice	Language	C
2026-06	0.44.1: extendable parameter files GA; old visualizer removed	Language	C
2026-07	0.45.6: publish modules to non-ACR OCI registries (experimental)	Ecosystem	M
2026-09	0.47.16: experimental docs generate; extends in bicepconfig.json	Language	C
2026-10	0.48.1: trusted custom clouds through BICEP_TRUSTED_CLOUDS	Security	C

Centre of gravity: Language (10), State and planning (3), Provisioning breadth (2)
Blind spots (no items): Configuration management, Orchestration, Scale, Bare metal, Packaging, Licensing
Driver mix: Vision 21%, Customer need 74%, Market window 5%, Upstream 0%, Portfolio 0%
Idea-to-need index: 0.21 (0 = demand-pulled, 1 = thesis-pushed)

Credibility: 17.5 / 25

Criterion	Score	Basis
Cadence	3.5	Ten minor versions in twelve months, about monthly; no published schedule
Roadmap transparency	3.5	Open GitHub repository, release notes and experimental feature docs; no written roadmap
Say-do	3.5	Experimental items reach GA (snapshot in 9 months, console in 6, extendable parameter files in 23); Kubernetes extension and local deploy still experimental after two years
Velocity	4	Several language and tooling items per release
Lifecycle stability	3	Still 0.x with breaking changes in minor versions and no support windows; ARM compatibility kept; deprecations carried out on notice

Commercial risk: 3.0 / 25 (lower is better)

Criterion	Score	Basis
Price and licence volatility	0.5	Free and MIT throughout; no pricing page exists
Purchase constraints	0.5	Nothing to buy; an Azure subscription is needed to deploy
Channel and access	0.5	Open download from GitHub, winget, the Azure CLI and the VS Code extension
Owner stability	0.5	Microsoft, built in house; no ownership change
Cost of staying supported	1	Free updates; the current CLI is expected; experimental features excluded from support; Arc-enabled SCVMM retires September 2029

Technical lock-in: 15.0 / 25 (lower is better)

Criterion	Score	Basis
Formats	3	Azure-specific language compiled to ARM JSON; open-source compiler and decompiler
Export path	2.5	Decompile ARM to Bicep and export stack resources as JSON; nothing out to another cloud or tool
Stack coupling	4	Azure resource model only
Hardware / cloud coupling	4	Azure control plane required even for on-prem VMs, through an Arc resource bridge; sovereign and custom clouds supported
Skills and tooling coupling	1.5	Large Azure skills base; Azure CLI and PowerShell skills carry over

Integrator fit: 16.0 / 20

Criterion	Score	Basis
Partner programme openness	3.5	Microsoft partner programme exists; terms not read; anyone can publish modules and contribute to Azure Verified Modules
Multi-tenancy and self-service	4	Azure RBAC with two deployment stack roles, management group scope, deny settings, Arc RBAC for on-prem VMs
API and infrastructure-as-code	4.5	First-class front end to ARM; SDKs in five languages; RPC client and language server packages
Skills and certification	4	Microsoft certifications and a large skills pool; specific tracks not checked

AI leverage: 5.0 / 20

How the product uses AI, scored per year like capability. Only GA counts.

Criterion	2019	2022	Today	Latest step
AI code and plan generation	n/a	0	1.5	2026: MCP server supplies resource schemas, Azure Verified Module metadata and best practices to a coding assistant; no Bicep generator of its own
AI platform stack	n/a	0	0	2021: None
AI-assisted operations	n/a	0	0	2021: None
Agent openness	n/a	1.5	3.5	2026: 0.40.2: MCP server in the VS Code extension and as a NuGet package; ten read-only tools, no deploy, no identity or audit layer; not labelled GA

Year by year: 2021: 1.5 · 2022: 1.5 · 2023: 1.5 · 2024: 1.5 · 2025: 3 · 2026: 5

AI say-do, 2023 to 2026: 1 AI items announced; 1 GA, 0 still preview, 0 pending, 0 dropped. Microsoft Learn labels the MCP server neither preview nor GA; it ships in the released extension and as a NuGet package, so it is counted as shipped.

Bicep's AI story is one local MCP server, shipped in the VS Code extension from 0.40.2 (2026-01-24) and as a NuGet package, with ten read-only tools for schemas, diagnostics, decompile, snapshots and Azure Verified Module metadata. It does not deploy, and the documentation claims no identity, guardrail or audit layer beyond local execution. There is no Bicep-specific code generator, no plan explanation and no AI in operations.

Reading

Bicep scores as the single-cloud reference for a language without a state file: Azure holds the state, what-if is the plan, and deployment stacks added the managed-resource list and deny settings that a state-based tool gets from its state file. The language itself is the strongest part of the record, with a release about every month and experimental features that do reach GA, if slowly. Breadth and bare metal are low by design: vSphere and Hyper-V are reachable only through Azure Arc, which needs a resource bridge and a live connection to Azure, and Proxmox VE, Nutanix, XCP-ng and KubeVirt have no path at all. The one thing to check is which features your templates rely on, because experimental features are excluded from Microsoft Support, and the Kubernetes extension and local deploy have stayed experimental for more than two years.

Open questions and items to re-score

Azure Arc-enabled VMware vSphere: the GA date was not read, so the 2024 breadth step is placed by the Graph extension preview; move it if the Arc date differs.
Microsoft Graph extension: a secondary blog reports GA on 2025-07-29 while the types repository still says preview; scored as preview.
Kubernetes extension and local deploy: experimental as of 2025-12-22 and 2026-07; re-score breadth if either reaches GA.
What-if for deployment stacks: announced as generally available on an undated Tech Community post; the date is unverified.
bicep test: GA status not checked; the language domain assumes no native test framework.
Azure Local cluster deployment with Bicep or ARM was not verified, so bare metal stays at 0.5.
Year of the 0.3.x releases and a Microsoft statement of production readiness were not found; the first scored year is 2021 by release sequence.
Whether the broader Azure MCP Server covers Bicep deployment was not assessed.