{"record":{"id":"1770ec4d87775295","repo":"microsoft/aspire","slug":"an-azure-principal-parameter-was-not-supplied-a-value-ensure","errorCode":null,"errorMessage":"An Azure principal parameter was not supplied a value. Ensure you are using an environment that supports role assignments, for example AddAzureContainerAppEnvironment.","messagePattern":"An Azure principal parameter was not supplied a value\\. Ensure you are using an environment that supports role assignments, for example AddAzureContainerAppEnvironment\\.","errorType":"exception","errorClass":"InvalidOperationException","httpStatus":null,"severity":"critical","filePath":"src/Aspire.Hosting.Azure/Provisioning/Provisioners/BicepProvisioner.cs","lineNumber":1387,"sourceCode":"        };\n    }\n\n    private static void PopulateWellKnownParameters(AzureBicepResource resource, ProvisioningContext context)\n    {\n        static void ValidateUnknownPrincipalParameter(ProvisioningContext context)\n        {\n            // Application principal parameters can only be populated in run mode. Published artifacts\n            // bind them from their outer template because the application identity can differ from the\n            // credential applying the deployment.\n\n            // We assume that the BicepProvisioner only runs in publish mode during `aspire deploy` operations\n            // and not from azd. azd fills in principal parameters during its deployment process with a managed\n            // identity it creates. The deployment-principal parameters are the exception: direct `aspire deploy`\n            // intentionally binds them from the current credential because that identity performs subsequent\n            // data-plane operations.\n            if (context.ExecutionContext.IsPublishMode)\n            {\n                throw new InvalidOperationException(\"An Azure principal parameter was not supplied a value. Ensure you are using an environment that supports role assignments, for example AddAzureContainerAppEnvironment.\");\n            }\n        }\n\n        if (resource.Parameters.TryGetValue(AzureBicepResource.KnownParameters.PrincipalId, out var principalId) && principalId is null)\n        {\n            ValidateUnknownPrincipalParameter(context);\n\n            resource.Parameters[AzureBicepResource.KnownParameters.PrincipalId] = context.Principal.Id;\n        }\n\n        var hasUserPrincipalId = resource.Parameters.TryGetValue(AzureBicepResource.KnownParameters.UserPrincipalId, out var userPrincipalId);\n        var populatedUserPrincipalId = false;\n        if (hasUserPrincipalId && userPrincipalId is null)\n        {\n            // Published artifacts bind this deployment-principal parameter from the outer\n            // main.bicep template. Direct `aspire deploy` has no outer template, so use the\n            // authenticated principal that performs the data-plane deployment.\n            resource.Parameters[AzureBicepResource.KnownParameters.UserPrincipalId] = context.Principal.Id;","sourceCodeStart":1369,"sourceCodeEnd":1405,"githubUrl":"https://github.com/microsoft/aspire/blob/25830f84bd145686607ad00c057b3f84e2e51d43/src/Aspire.Hosting.Azure/Provisioning/Provisioners/BicepProvisioner.cs#L1369-L1405","documentation":"During Bicep deployment parameter binding, a principal-related parameter (e.g. PrincipalId) was left null. In publish mode Aspire refuses to continue because role-assignment parameters require an environment that populates them (such as one created with AddAzureContainerAppEnvironment); azd normally fills these with a managed identity.","triggerScenarios":"Running `aspire publish`/deploy where a Bicep resource declares AzureBicepResource.KnownParameters.PrincipalId (or ValidateUnknownPrincipalParameter path) but no value was bound, and context.ExecutionContext.IsPublishMode is true.","commonSituations":"Using a plain publish environment that doesn't support role assignments; forgetting to configure AddAzureContainerAppEnvironment; migration from azd flows where azd silently supplied principal parameters; calling aspire deploy without a deployment-capable environment.","solutions":["Use an environment that supports role assignments, e.g. builder.AddAzureContainerAppEnvironment(...).","Explicitly supply the principal parameters on the resource (Params[KnownParameters.PrincipalId] = ...) before publishing.","If you intend azd-style deployment, run through the flow that populates principal parameters instead of direct publish.","Verify with context that the resource's Parameters dictionary has non-null PrincipalId/PrincipalType before publishing."],"exampleFix":"// before\nbuilder.AddAzureEnvironment(); // no role-assignment support\n// after\nbuilder.AddAzureContainerAppEnvironment(\"env\");","handlingStrategy":"validation","validationCode":"if (resource.Parameters.TryGetValue(AzureBicepResource.KnownParameters.PrincipalId, out var pid) && pid is null)\n{\n    throw new InvalidOperationException(\"PrincipalId is unset; publish requires an environment supporting role assignments (AddAzureContainerAppEnvironment).\");\n}","typeGuard":null,"tryCatchPattern":"try { await provisioner.ProvisionAsync(...); } catch (InvalidOperationException ex) when (ex.Message.Contains(\"principal parameter\")) { logger.LogError(ex, \"Publish environment does not support role assignments\"); throw; }","preventionTips":["Always create publish environments with AddAzureContainerAppEnvironment.","Never leave KnownParameters.PrincipalId null when publishing.","Test `aspire publish` in CI to catch missing principal configuration early."],"tags":["azure","bicep","provisioning","role-assignment","publish"],"backgroundTag":"missing-required-config","analyzedSha":"25830f84bd145686607ad00c057b3f84e2e51d43","analyzedAt":"2026-09-16T11:10:06.193Z","contentChangedAt":"2026-09-16T11:10:06.193Z","schemaVersion":2},"datasetVersion":"2026-09-21T04:17:39.646Z"}