[BUG]Microsoft.DocumentDB/databaseAccounts - Deletes existing config when no property is passed for ipRules

[chassq]

API Spec link

https://learn.microsoft.com/en-us/azure/templates/microsoft.documentdb/databaseaccounts?pivots=deployment-language-bicep

API Spec version

2025-11-01-preview

Describe the bug

Not sure where to submit this so hope this is the right place. When we use Bicep to create a Cosmos Database account we do not setup up ipRules. We a have a separate process which does this after a deployment. We do understand we could set the ipRules via bicep but it works out for us better the other way. However when we re-deploy the account with our ipRules se the re-deploy removes all of our ipRules even when we do not pass a property value for ipRules. This seems odd to us as Bicep is supposed to be idempotent.

Expected behavior

In our a case a re-deploy should not remove our ipRules if no value is passed.

Actual behavior

See above

Reproduction Steps

1. Create a cosmos account
2. Set the ipRules (add a public ip for example)
3. Redeploy
4. ipRules are gone.

Environment

Latest version of bicep