Separate permitted Bicep array values from the number of required selections
Review membership and item-count requirements separately before accepting a deployment input.
Read the guideDSE security knowledge hubSecurity knowledge,
Security knowledge,
without the noise.
Page 121 of the DSE Security Knowledge Hub, with source-backed guidance, checklists, explainers, and playbooks.
DSE-authoredOfficial sourcesReviewed guidance
Search the library DSE post stream
3,000 articlesGuidance and analysis from DSE
Do not equate managed-application JIT notifications with manual approval
Automatic approval mode notifies approvers but grants the request without waiting for one of them to approve it.
Read the guide
Keep runtime resource lookups out of ARM parameter defaults
Place a proposed default in the correct evaluation phase before changing deployment order.
Read the guide
Keep the prior Recovery Services encryption key available through rotation
When can the previous key version be retired after Recovery Services vault key autorotation?
Read the guide
Generate confidential-container enforcement policy through the supported tooling
Can a handwritten enforcement policy substitute for generated policy on confidential Azure Container Instances?
Read the guide
Treat a custom DDoS threshold as a replacement for that protocol's autotuning
Does a preview Azure DDoS custom threshold supplement or replace adaptive tuning?
Read the guide
Do not assume every Service Fabric node retains the same old certificates
Certificate rotation through the Key Vault VM extension can leave different certificate histories on existing and newly added nodes.
Read the guide
Fix the Site Recovery appliance's address choice before registration
Which appliance identity and installation choices should be settled before configuring modernized VMware or physical-server recovery?
Read the guide
Do not use blob tag search as a complete inventory of previous versions
Tags can remain attached to an older blob version without being available to the blob index query engine.
Read the guide
Treat secondary-region storage reads as potentially inconsistent across related updates
A successful read from a geo-redundant secondary can combine changes that have not yet arrived in their original order.
Read the guide