Bringing Day Zero Microsoft Graph Support to Azure Bicep

As many of you know, I am a big fan of Infrastructure as Code. It allows me to declaratively define the resources I want to deploy to Azure, making deployments more consistent, repeatable, and manageable. Microsoft introduced some time ago extensibility for Azure Bicep through the Microsoft Graph Extension. While this is a great step forward, the extension currently supports only a subset of Microsoft Graph APIs. As a result, I often rely on the Terraform Microsoft Graph Provider whenever I need access to newer or unsupported Graph capabilities. However, I prefer to keep my infrastructure and identity deployments within a single Bicep based workflow. That desire led me to explore a different approach: building a custom Azure Bicep extension that provides day zero support for Microsoft Graph APIs, allowing me to use newly released Graph capabilities directly from Bicep without waiting for official support. While I could do everything by writing my own code, why not just vibecode it all the way and see how far we get? To make this possible, we are going to make use of Azure Bicep Local Deploy, which enables deployments to be executed through custom deployment providers running locally. Instead of being limited to the resource providers that Azure or the official Microsoft Graph Extension expose, we can build our own provider that translates Bicep resources into Microsoft Graph API calls.

In this blog, we’ll use AI assisted development to create a custom Bicep extension from scratch. The goal is simple: expose Microsoft Graph resources through a local deployment provider and make them available as first class resources within our Bicep templates. By the end, we’ll be able to deploy and manage Microsoft Graph objects directly from Bicep, even when those APIs are not yet supported by the official extension. Let’s see how far vibecoding can take us. For this I used the GitHub Copilot application which is awesome, we can ask it a question and it will work it out. Building it, I had to reprompt and guide it the right direction to get the desired result.

You can decide either to work in a local folder or use a GitHub repository for example. 💪🏻

After several days of conversations, testing, and running the Microsoft Graph Bicep Extension locally,zerodaygraph is now ready for use. It’s great to see how, with the help of AI, an idea can evolve into a working solution through rapid iteration and experimentation. This has made the entire process much faster and easier.

Next we need to update the bicepconfig.json to consume our new Bicep Extension

{
  "experimentalFeaturesEnabled": {
    "localDeploy": true
  },
  "extensions": {
    "zerodaygraph": "./bin/bicep-ext-zerodaygraph"
  },
  "implicitExtensions": []
}

The first test is to verify the authenticated identity. We can run bicep local-deploy .\getMe.bicepparam and view the output in the terminal. This confirms that we are authenticated correctly and can now interact with Microsoft Graph resources.

Get Brian Veldman’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

How about creating a Microsoft Team resource? For each deployment, I want to choose the name, description, and the user objectId that will be the owner of the Team. I blurred the objectID of the owner for security reasons, time to run the deployment using bicep local-deploy .\buildTeams.bicepparam

And when checking within Microsoft Teams admin center we can see that the Microsoft Teams has been created, isn’t it sweet? 😍

Or how about creating a Conditional Access policy through Bicep? No problem. In this example, we will create a Conditional Access policy that requires MFA for Exchange Online for a specific group in Entra ID, based on the group’s ID. Time to run the deployment using bicep local-deploy .\caRule.bicepparam

When checking the Conditional Access policies in Entra ID, we can see that the policy has been created successfully and includes the target resource in the Bicep template. 💪🏻

Or how about deploying administrative units using Bicep? With this vibecoded zerodaygraph Bicep local deploy extension I can speak to every Graph API! 😍

When checking the Admin units in my tenant, we can see that the IT Netherlands Administrative Unit has been created! 😍

From now on, you know how to use AI assisted development to create a custom Bicep extension from scratch, for example, to deploy Microsoft Graph resources using the Bicep Local Deploy Extension. What I really like is that, with the help of AI, we can turn an idea into a working solution for testing in a very short time. This makes the entire development process much simpler and more efficient. Of course, you should always be mindful of security and understand how the extension is built. This blog is simply intended to give you a perspective on how quickly AI can accelerate your development journey. Feel free to clap for this story and let me know if you have any feedback. I look forward to seeing you in the next session. Until then, take care! ❤️