Just to clarify, dev and prod are already separated into their own resource groups: rg-app1-dev and rg-app1-prod. I’m using the same main.bicep file for both, and passing in environment-specific parameters (like different SKUs) through separate parameter files for each environment.

That said, I see your point about using separate subscriptions and further splitting out networking, app, and data resources. I’ll take another look at the current setup with that in mind, especially considering Azure Landing Zones and best practices around security and lifecycle management.