diff --git a/.github/workflows/deploy_tre.yml b/.github/workflows/deploy_tre.yml
index bddea6979f..9557ea256e 100644
--- a/.github/workflows/deploy_tre.yml
+++ b/.github/workflows/deploy_tre.yml
@@ -16,6 +16,11 @@ on:  # yamllint disable-line rule:truthy
         type: environment
         default: CICD
         required: true
+      DEPLOY_MODE:
+        description: The deployment mode to use (plan or apply)
+        type: string
+        default: apply
+        required: true
 
 # This will prevent multiple runs of this entire workflow.
 # We should NOT cancel in progress runs as that can destabilize the environment.
@@ -38,6 +43,7 @@ jobs:
       environmentName: ${{ github.event.inputs.environment || 'CICD' }}
       E2E_TESTS_NUMBER_PROCESSES: 1
       DEVCONTAINER_TAG: 'latest'
+      DEPLOY_MODE: ${{ github.event.inputs.DEPLOY_MODE }}
     secrets:
       AAD_TENANT_ID: ${{ secrets.AAD_TENANT_ID }}
       ACR_NAME: ${{ secrets.ACR_NAME }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 236f0e2055..859acf3fa8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,9 +7,10 @@ FEATURES:
 
 ENHANCEMENTS:
 * Key Vaults should use RBAC instead of access policies for access control ([#4000](https://github.com/microsoft/AzureTRE/issues/4000))
-* Split log entries with [Log chunk X of Y] for better readability. ([[#3992](https://github.com/microsoft/AzureTRE/issues/3992)
+* Split log entries with [Log chunk X of Y] for better readability. ([#3992](https://github.com/microsoft/AzureTRE/issues/3992))
 * Expose APP_SERVICE_SKU build variable to allow enablement of App Gateway WAF ([#4111](https://github.com/microsoft/AzureTRE/pull/4111))
 * Update Terraform to use Azure AD authentication rather than storage account keys ([#4103](https://github.com/microsoft/AzureTRE/issues/4103))
+* Add DEPLOY_MODE environemtn variable to enable Terraform plan ([#4047](https://github.com/microsoft/AzureTRE/pull/4047))
 
 BUG FIXES:
 - Update KeyVault references in API to use the version so Terraform cascades the update ([#4112](https://github.com/microsoft/AzureTRE/pull/4112))
diff --git a/devops/scripts/terraform_wrapper.sh b/devops/scripts/terraform_wrapper.sh
old mode 100755
new mode 100644
index 6f8c66a0d1..9f6c3ced9c
--- a/devops/scripts/terraform_wrapper.sh
+++ b/devops/scripts/terraform_wrapper.sh
@@ -5,7 +5,7 @@ set -e
 function usage() {
     cat <<USAGE
 
-    Usage: $0 [-g | --mgmt-resource-group-name ]  [-s | --mgmt-storage-account-name] [-n | --state-container-name] [-k | --key] [-c | --cmd] [-l | --logfile]
+    Usage: $0 [-g | --mgmt-resource-group-name ]  [-s | --mgmt-storage-account-name] [-n | --state-container-name] [-k | --key] [-c | --cmd] [-l | --logfile] [-d | --deploy-mode]
 
     Options:
         -g, --mgmt-resource-group-name      Management resource group name
@@ -14,6 +14,7 @@ function usage() {
         -k, --key                           Key
         -c, --cmd                           Command to execute
         -l, --logfile                       Log file to write output to
+        -d, --deploy-mode                   Deployment mode (plan or apply)
 USAGE
     exit 1
 }
@@ -49,6 +50,10 @@ while [ "$1" != "" ]; do
         shift
         tf_logfile=$1
         ;;
+    -d | --deploy-mode)
+        shift
+        deploy_mode=$1
+        ;;
     *)
         usage
         ;;
@@ -91,18 +96,31 @@ if [[ -z ${tf_logfile+x} ]]; then
     echo -e "No logfile provided, using ${tf_logfile}\n"
 fi
 
+if [[ -z ${deploy_mode+x} ]]; then
+    deploy_mode="apply"
+    echo -e "No deploy mode provided, using ${deploy_mode}\n"
+fi
+
 terraform init -input=false -backend=true -reconfigure \
     -backend-config="resource_group_name=${mgmt_resource_group_name}" \
     -backend-config="storage_account_name=${mgmt_storage_account_name}" \
     -backend-config="container_name=${container_name}" \
     -backend-config="key=${key}"
 
+if [[ ${DEPLOY_MODE} == "plan" ]]; then
+    tf_command="terraform plan -out=tfplan && terraform show -json tfplan > plan_output.json"
+fi
+
 RUN_COMMAND=1
 while [ $RUN_COMMAND = 1 ]
 do
     RUN_COMMAND=0
     TF_CMD="$tf_command"
 
+    if [ "$deploy_mode" == "plan" ]; then
+        TF_CMD="terraform plan -out=tfplan && terraform show -json tfplan > plan_output.json"
+    fi
+
     script -c "$TF_CMD" "$tf_logfile"
 
     # upload the log file?
@@ -128,3 +146,6 @@ do
 done
 
 
+if [ "$deploy_mode" == "plan" ]; then
+    echo "Terraform plan output saved to plan_output.json"
+fi
diff --git a/docs/tre-admins/setup-instructions/workflows.md b/docs/tre-admins/setup-instructions/workflows.md
index dfc21b8de5..d914e465b5 100644
--- a/docs/tre-admins/setup-instructions/workflows.md
+++ b/docs/tre-admins/setup-instructions/workflows.md
@@ -147,7 +147,7 @@ Configure variables used in the deployment workflow:
 | `ENABLE_SWAGGER` | Optional. Determines whether the Swagger interface for the API will be available. Default value is `false`. |
 | `FIREWALL_SKU` | Optional. The SKU of the Azure Firewall instance. Default value is `Standard`. Allowed values [`Basic`, `Standard`, `Premium`]. See [Azure Firewall SKU feature comparison](https://learn.microsoft.com/en-us/azure/firewall/choose-firewall-sku). |
 | `APP_GATEWAY_SKU` | Optional. The SKU of the Application Gateway. Default value is `Standard_v2`. Allowed values [`Standard_v2`, `WAF_v2`] |
-
+| `DEPLOY_MODE` | Optional. Control whether the terraform operations run in `plan` mode or `apply` mode. Defaults to `apply` |
 
 ### Deploy the TRE using the workflow
 
diff --git a/docs/tre-admins/upgrading-tre.md b/docs/tre-admins/upgrading-tre.md
index ca56c57bcf..5e454575e2 100644
--- a/docs/tre-admins/upgrading-tre.md
+++ b/docs/tre-admins/upgrading-tre.md
@@ -42,3 +42,21 @@ If you wish to deploy the Azure TRE from a forked repository you can change the
 - `"OSS_REPO": "myorg/AzureTRE"` (to point to fork of the Azure TRE in your GitHub organisation)
 
 When changing `OSS_REPO` ensure the `OSS_VERSION` variable refers to a GitHub ref on the repository fork.
+
+## Check infrastructure changes using a Terraform plan
+
+The `DEPLOY_MODE` variable allows you to control whether the deployment runs in 'plan' mode or 'apply' mode. In 'plan' mode, the terraform plan is generated and can be reviewed before applying. In 'apply' mode, the terraform plan is applied directly. This can be useful when evaluating an updgrade and don't want to make any actual changes to the deployed infrastructure.
+
+### Setting the DEPLOY_MODE variable
+
+To set the `DEPLOY_MODE` variable, use the following commands:
+
+```bash
+export DEPLOY_MODE=plan
+```
+
+### Example usage
+```bash
+export DEPLOY_MODE=plan
+make core
+```