Deploy sp referencing app reg within module errors out

[xhoogland]

Bicep version
N/a, using AzureResourceManagerTemplateDeployment@3 in Azure DevOps Server 25H2 (on-premise)

Resource and API version
Microsoft.Graph/servicePrincipals@v1.0 combined with Microsoft.Graph/applications@v1.0

Auth flow
Automated. Service connection authenticates with/via app registration using a certificate towards Azure.

Deployment details
Correlation id: e48512ff-cb2c-4d2b-8fe8-5bd8f673b61f
Start time: 18-8-2026, 14:48:50

Describe the bug
When deploying, both defined in a seperate file/module, an app registration and service principal referencing the app registration's appId, it fails with: The language expression property 'appId' doesn't exist, available properties are 'displayName, uniqueName, identifierUris, api, appRoles, owners'.
When they are defined in a directly deployed bicep, all goes well.

To Reproduce
deploy.bicep:

// Left params out since not relevant.
module appRegistration './app-registration.bicep' = {
  name: 'appRegistrationDeployment-${depName}'
  params: {
    name: appRegistrationName
  }
}

app-registration.bicep:

// Left params out since not relevant.
resource appRegistration 'Microsoft.Graph/applications@v1.0' = {
  displayName: name
  uniqueName: name
}

resource servicePrincipal 'Microsoft.Graph/servicePrincipals@v1.0' = {
  appId: appRegistration.appId
}

Additional context
It seems like it has something to do with it being in a module. Using another name for the resource does not help either, tried that to be sure it was not related to that.

[slavizh]

Xander Hoogland (@xhoogland) have you tried deploying the service principal via another module and passing the app id via parameter? If not mistaken this is by design as the app ID is not available until the resource is created. Similar situation with with Azure resources if you try to reference the location of a resource in properties of another resource when they are defined in the same template. Overall if it is by design it would be good to throw error right in the template rather doing that in deployment. //cc Dan Kershaw [MSFT] (@dkershaw10)

[xhoogland]

Mmhh, moving only the servicePrincipal-resource to a seperate module does give me both an app registration and service principal.

It is in my opinion still a bit strange though that moving those 2 resource suddenly to another file/in a seperate module causes this strange issues...

[xhoogland]

I stand corrected. That was pure luck of it working on the first try.