param vmImageJson string = '{"publisher":"MicrosoftWindowsServer", "offer":"WindowsServer", "sku":"2016-Datacenter", "version":"latest"}'
// Create the NIC...
resource nic 'Microsoft.Network/networkInterfaces@2018-10-01' = {
  name:  '${virtualMachineName}_nic'
  location: location
  properties: {
    ipConfigurations: [
        name: 'ipconfig1'
        properties: {
          subnet: {
            id: subnetRef
          privateIPAllocationMethod: 'Dynamic'
          primary: true
          privateIPAddressVersion: 'IPv4'
    enableAcceleratedNetworking: enableAcceleratedNetworking
  dependsOn: []
// Create the VM, using the NIC we created earlier...
resource vm 'Microsoft.Compute/virtualMachines@2021-03-01' = {
  name: virtualMachineName
  location: location
  properties: {
    licenseType: hybridUseBenefit  
    hardwareProfile: {
      vmSize: virtualMachineSize
    storageProfile: {
      osDisk: {
        createOption: 'FromImage'
        managedDisk: {
          storageAccountType: osDiskType
      imageReference: json(vmImageJson)
    networkProfile: {
      networkInterfaces: [
          id: nic.id
    osProfile: {
      computerName: virtualMachineName
      adminUsername: adminUsername
      adminPassword: adminPassword
      windowsConfiguration: {
        enableAutomaticUpdates: true
        provisionVMAgent: true
        patchSettings: {
          enableHotpatching: enableHotpatching
          patchMode: patchMode
    diagnosticsProfile: {
      bootDiagnostics: {
        enabled: true
        storageUri: 'https://${diagnosticsStorageAccountName}.blob.core.windows.net/'
  identity: {
    type: 'SystemAssigned'
Replace imageReference: json(vmImageJson) with string equivalent (will work):

imageReference: json('{"publisher":"MicrosoftWindowsServer", "offer":"WindowsServer", "sku":"2016-Datacenter", "version":"latest"}')
          
Hi all, can't reproduce at this time and original correlation ID is no longer available, unless there's a way for me to get it past the one week window.
Cheers.
          
Thanks @alex-frankel. File is attached.   Execute with the following (sry for formatting):
az deployment group create `
--template-file create_vm.bicep 
--parameters virtualMachineName='myLinuxVm' `
             adminUsername='sadmin' `
             adminPassword='password123' `
             virtualMachineSize='Standard_D4s_v5' `
             domainJoinerUsername='useraccount1' `
             domainJoinerPassword='userpassword1' `
             licenseType='None' `
             vmImagePublisher='center-for-internet-security-inc' `
             vmImageOffer='cis-centos-7-v2-1-1-l1' `
             vmImageSku='cis-centos7-l1' `
             vmImageVersion='latest' `
             subnetName='mySubnet' `
             osType='linux' `
             marketplacePlanJSON='{"name": "cis-centos7-l1", "publisher": "center-for-internet-security-inc", "product": "cis-centos-7-v2-1-1-l1"}' `
--resource-group 'myRG' `
--name 'create_vm.bicep-myLinuxVM'
It will fail with:

{'code': 'InvalidTemplate', 'message': "Deployment template validation failed: 'The template variable 'marketplacePlan' is not valid: Unable to evaluate the template language function 'json'. The argument provided is not a valid JSON string.. Please see https://aka.ms/arm-template-expressions for usage details.'.", 'additionalInfo': [{'type': 'TemplateViolation', 'info': {'lineNumber': 132, 'linePosition': 133, 'path': 'properties.template.variables.marketplacePlan'}}]}
Upgraded to v0.4.1272 and still failing.
Cheers.
create-vm.bicep.txt
          
In order to test this repro, we would also need all the module files. Can you provide those?
I also tried to create a smaller repro using snippets from the code you provided, but everything I tried below deployed successfully:
attempt 1:
var foo = json('{"name": "cis-centos7-l1", "publisher": "center-for-internet-security-inc", "product": "cis-centos-7-v2-1-1-l1"}')
output foo object = foo




    

attempt 2:
param bar string
var foo = json(bar)
output foo object = foo
Deployed with command:
az deployment group create -f ./scratch2.bicep -g brittle-hollow -p bar='{"name": "cis-centos7-l1", "publisher": "center-for-internet-security-inc", "product": "cis-centos-7-v2-1-1-l1"}'
attempt 3:
param marketplacePlanJSON string = ''
var marketplacePlan = (length(marketplacePlanJSON) > 0) ? json('{"name": "cis-centos7-l1", "publisher": "center-for-internet-security-inc", "product": "cis-centos-7-v2-1-1-l1"}') : null
          
I believe this an issue with PowerShell's escaping rules when invoking az cli, rather than Bicep.
I experimented with the following file:
targetScope = 'subscription'
param marketplacePlanJSON string = ''
var marketplacePlan = (length(marketplacePlanJSON) > 0) ? json(marketplacePlanJSON) : null
When I use the following command in PowerShell, I get an error:
az deployment sub validate --location westus --name foo --template-file create-vm.bicep --parameters marketplacePlanJSON='{"name": "cis-centos7-l1", "publisher": "center-for-internet-security-inc", "product": "cis-centos-7-v2-1-1-l1"}'
If I instead double up the quotes in the JSON string, everything works as expected:
az deployment sub validate --location westus --name foo --template-file create-vm.bicep --parameters marketplacePlanJSON='{""name"": ""cis-centos7-l1"", ""publisher"": ""center-for-internet-security-inc"", ""product"": ""cis-centos-7-v2-1-1-l1""}'
In the first scenario, by inspecting the API call, I can see that PowerShell is stripping the double quotes from the JSON string:
"parameters": {
  "marketplacePlanJSON": {
    "type": "String",
    "value": "{name: cis-centos7-l1, publisher: center-for-internet-security-inc, product: cis-centos-7-v2-1-1-l1}"
          
Might be helpful to include a mention of this in the error returned?  I see a lot of issues reported here that are due to PowerShell escaping.
Appreciate the investigation nonetheless!  Cheers.