Quickstart: Deploy Azure Health Data Service with Bicep

In this quickstart, use a Bicep file to create an Azure Health Data Services workspace with a Fast Healthcare Interoperability Resources (FHIR) service and a Digital Imaging Communications in Medicine (DICOM) service.

Bicep is a domain-specific language (DSL) that uses declarative syntax to deploy Azure resources. It provides concise syntax, reliable type safety, and support for code reuse. Bicep offers the best authoring experience for your infrastructure-as-code solutions in Azure.

Prerequisites

An Azure subscription. If you don't have an Azure subscription, create a free account.

• Use the Bash environment in Azure Cloud Shell. For more information, see Get started with Azure Cloud Shell.

  

• If you prefer to run CLI reference commands locally, install the Azure CLI. If you're running on Windows or macOS, consider running Azure CLI in a Docker container. For more information, see How to run the Azure CLI in a Docker container.

  • If you're using a local installation, sign in to the Azure CLI by using the az login command. To finish the authentication process, follow the steps displayed in your terminal. For other sign-in options, see Authenticate to Azure using Azure CLI.

  • When you're prompted, install the Azure CLI extension on first use. For more information about extensions, see Use and manage extensions with the Azure CLI.

  • Run az version to find the version and dependent libraries that are installed. To upgrade to the latest version, run az upgrade.

Review the Bicep file

The Bicep file used in this quickstart is from Azure Quickstart Templates.

@minLength(3)
@maxLength(16)
@description('Basename that is used to name provisioned resources. Should be alphanumeric, at least 3 characters and up to or less than 16 characters.')
param basename string

@description('The location where the resources are deployed. ')
var location = 'eastus'

@description('The name of the Azure Health Data Services workspace.')
var workspaceName = replace('ws-${basename}', '-', '')

@description('The name of the FHIR service.')
var fhirServiceName = 'fhir-${basename}'

@description('Relative URI path for the FHIR service. ')
var fhirAudience = 'https://${workspaceName}-${fhirServiceName}.fhir.azurehealthcareapis.com'


@description('The name of the DICOM service.')
var dicomServiceName = 'dicom-${basename}'

@description('The FHIR version to use. Defaults to R4.')
var fhirKind = 'fhir-R4'

@description('The Microsoft Entra tenant ID for FHIR authentication.')
var tenantId = subscription().tenantId

// Azure Health Data Services workspace
resource workspace 'Microsoft.HealthcareApis/workspaces@2025-04-01-preview' = {
  name: workspaceName
  location: location
  properties: {
    publicNetworkAccess: 'Enabled'
  }
}

// FHIR service (child of workspace)
resource fhirService 'Microsoft.HealthcareApis/workspaces/fhirservices@2025-04-01-preview' = {
  parent: workspace
  name: fhirServiceName
  location: location
  kind: fhirKind
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    authenticationConfiguration: {
      authority: '${environment().authentication.loginEndpoint}${tenantId}'
      audience: fhirAudience
    }
    publicNetworkAccess: 'Enabled'
  }
}

// DICOM service (child of workspace)
resource dicomService 'Microsoft.HealthcareApis/workspaces/dicomservices@2025-04-01-preview' = {
  parent: workspace
  name: dicomServiceName
  location: location
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    publicNetworkAccess: 'Enabled'
  }
}

// Outputs
output workspaceId string = workspace.id
output fhirServiceId string = fhirService.id
output fhirServiceUrl string = fhirAudience
output dicomServiceId string = dicomService.id
output dicomServiceUrl string = dicomService.properties.serviceUrl

The Bicep file defines three Azure resources.

• Microsoft.HealthcareApis workspaces
• Microsoft.HealthcareApis workspaces/fhirservices
• Microsoft.HealthcareApis workspaces/dicomservices

Prepare your environment

You can deploy the Bicep file by using Azure CLI or Azure PowerShell. This example uses Azure CLI in Bash.

1. Save your Bicep file locally as main.bicep.

2. Open a Bash shell and go to the directory where you saved the Bicep file.

3. Run the following command to sign in to Azure from the CLI. Follow the prompts to complete the authentication process.

   az login
   

4. Run the upgrade command to make sure you're running the latest version of Azure CLI.

   az upgrade
   

Create resource group

Use the az group create command to create a resource group. Replace the <placeholders> with your values.

az group create --name <resource group name> --location westus2

Deploy resources

Use the az deployment group create command to deploy your resources. Replace the <placeholders> with your values.

az deployment group create --resource-group <resource group name> --template-file main.bicep

The output of this command is a JSON-formatted listing of the deployment. You can view and manage these resources through the az healthcareapis workspace commands.

Debug Bicep files

You can debug Bicep files in Visual Studio Code or in other environments. Troubleshoot issues based on the response. You can also review the activity log for a specific resource in the resource group while debugging.

In addition, you can use the output value for debugging or as part of the deployment response. For example, you can define two output values to display the values of authority and audience for the FHIR service in the response. For more information, see Outputs in Bicep.

output stringOutput1 string = authority
output stringOutput2 string = audience

Clean up resources

When you're finished with the resources you created, delete the resource group. Deleting the resource group deletes all the resources created in this exercise. To delete the resource group, run the az group delete command. Replace the <placeholders> with your values.

az group delete --resource-group <resource group name>

Next steps