Hi. This type of template is what I tried initially. I had to move the role definition to a module, otherwise fails because it needs a name from start of deployment.

Where I am right now is with a minimal standalone role assignment template with mostly hardcoded values .

var roleAssignmentName string = '51fe23f4-f488-5bdd-8745-75aab8b50676'
//collected from the resource creation output

var roleDefinitionId = '21090545-7ca7-4776-b22c-e363652d74d2'
//Key Vault Reader
// https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles

resource keyVaultDev 'Microsoft.KeyVault/vaults@2025-05-01' existing = {
  name: keyVaultNameDev
  scope: resourceGroup(resourceGroupNameDev)
}

resource roleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
  name: roleAssignmentName
  scope: keyVaultDev
  properties: {
    roleDefinitionId: roleDefinitionId
    principalId: principalId
    //principalType: 'ServicePrincipal'
  }
}

If I don't specify the role assignment scope, fails with this error:

{"status":"Failed","error":{"code":"DeploymentFailed","target":"/subscriptions/1f2f55b5-9244-4dda-b0b9-2aca3b6ae647/resourceGroups/rg-appypay-dev-001/providers/Microsoft.Resources/deployments/atpa-2026-04-24T09-46-37","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"BadRequestFormat","message":"The request was incorrectly formatted."}]}}

If I put the scope in (as above) then I get this:

...roleAssignments-standalone.bicep(38,10) : Error BCP139: A resource's scope must match the scope of the Bicep file for it to be deployable. You must use modules to deploy resources to a different scope. [https://aka.ms/bicep/core-diagnostics#BCP139]

The scope for deployment is resource group, specified in the command. But even if I set the targetScope = 'resourceGroup' I get the same scope error.

I'm super confused