{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
        "slug": "dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link",
        "url": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/"
        },
        "title": "Make a workbook ARM action visibly different from a navigation link",
        "summary": "What should a workbook reviewer inspect before exposing a link that executes an ARM request?",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "network-infrastructure",
            "label": "Networks & infrastructure",
            "alt": "Resilient network core with engineered blue and gold data paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "networks-infrastructure",
                "name": "Networks & Infrastructure",
                "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-10T00:31:49+00:00",
        "modified_at": "2026-09-10T00:31:59+00:00",
        "reviewed_on": "2026-09-09",
        "reading_minutes": 2,
        "word_count": 239,
        "potentially_affected": "Azure Monitor workbooks with ARM action links.",
        "dse_recommendation": "Expose the intended target and operation clearly, and inspect the resolved request before enabling an operational workbook action.",
        "primary_source": {
            "name": "Azure Workbooks link actions - Azure Monitor | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Workbook link actions include both navigation and ARM operations. The ARM action configuration specifies an API path, method, parameters, headers and JSON body; its method choices include POST, PUT, PATCH and DELETE. Parameters and grid-column values can supply request content. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<p>Selecting the link opens a configured run view. The action executes when the user selects its run button. View Request Details exposes the request method and endpoint, while an Azure portal notification reports progress and outcome. <a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>This review concerns Azure Monitor workbooks with ARM action links. Keep it separate from ordinary resource navigation and workbook formatting. Do not describe an action as a harmless detail view merely because both begin with a click.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends wording the link and run button around the actual operation. Include the intended resource in the description and identify which row or parameter supplies it. Review every dynamic input against the operator&#8217;s intended selection. For a destructive request, require the existing change-approval process and an explicit target check; publishing a workbook is not approval to execute its actions.</p>\n<h2>Verification</h2>\n<p>Use a disposable resource and inspect the resolved request before execution. Compare the displayed target with the endpoint and body, then record the notification and resulting resource state. Repeat with a different row to detect a fixed or incorrectly bound target. Keep the reviewed workbook version with these observations.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Workbook link actions</a>.</p>",
        "content_text": "Source facts\nWorkbook link actions include both navigation and ARM operations. The ARM action configuration specifies an API path, method, parameters, headers and JSON body; its method choices include POST, PUT, PATCH and DELETE. Parameters and grid-column values can supply request content. Microsoft Learn.\nSelecting the link opens a configured run view. The action executes when the user selects its run button. View Request Details exposes the request method and endpoint, while an Azure portal notification reports progress and outcome. Microsoft Learn.\nApplicability\nThis review concerns Azure Monitor workbooks with ARM action links. Keep it separate from ordinary resource navigation and workbook formatting. Do not describe an action as a harmless detail view merely because both begin with a click.\nDSE recommendation\nDSE recommends wording the link and run button around the actual operation. Include the intended resource in the description and identify which row or parameter supplies it. Review every dynamic input against the operator’s intended selection. For a destructive request, require the existing change-approval process and an explicit target check; publishing a workbook is not approval to execute its actions.\nVerification\nUse a disposable resource and inspect the resolved request before execution. Compare the displayed target with the endpoint and body, then record the notification and resulting resource state. Repeat with a different row to detect a fixed or incorrectly bound target. Keep the reviewed workbook version with these observations.\nOfficial references\nMicrosoft Learn: Workbook link actions.",
        "content_markdown": "## Source facts\n\nWorkbook link actions include both navigation and ARM operations. The ARM action configuration specifies an API path, method, parameters, headers and JSON body; its method choices include POST, PUT, PATCH and DELETE. Parameters and grid-column values can supply request content. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions).\n\nSelecting the link opens a configured run view. The action executes when the user selects its run button. View Request Details exposes the request method and endpoint, while an Azure portal notification reports progress and outcome. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions).\n\n## Applicability\n\nThis review concerns Azure Monitor workbooks with ARM action links. Keep it separate from ordinary resource navigation and workbook formatting. Do not describe an action as a harmless detail view merely because both begin with a click.\n\n## DSE recommendation\n\nDSE recommends wording the link and run button around the actual operation. Include the intended resource in the description and identify which row or parameter supplies it. Review every dynamic input against the operator’s intended selection. For a destructive request, require the existing change-approval process and an explicit target check; publishing a workbook is not approval to execute its actions.\n\n## Verification\n\nUse a disposable resource and inspect the resolved request before execution. Compare the displayed target with the endpoint and body, then record the notification and resulting resource state. Repeat with a different row to detect a fixed or incorrectly bound target. Keep the reviewed workbook version with these observations.\n\n## Official references\n\n[Microsoft Learn: Workbook link actions](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-09"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Make a workbook ARM action visibly different from a navigation link",
                        "item": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
                "url": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/",
                "headline": "Make a workbook ARM action visibly different from a navigation link",
                "description": "What should a workbook reviewer inspect before exposing a link that executes an ARM request?",
                "abstract": "What should a workbook reviewer inspect before exposing a link that executes an ARM request?",
                "articleBody": "Source facts\nWorkbook link actions include both navigation and ARM operations. The ARM action configuration specifies an API path, method, parameters, headers and JSON body; its method choices include POST, PUT, PATCH and DELETE. Parameters and grid-column values can supply request content. Microsoft Learn.\nSelecting the link opens a configured run view. The action executes when the user selects its run button. View Request Details exposes the request method and endpoint, while an Azure portal notification reports progress and outcome. Microsoft Learn.\nApplicability\nThis review concerns Azure Monitor workbooks with ARM action links. Keep it separate from ordinary resource navigation and workbook formatting. Do not describe an action as a harmless detail view merely because both begin with a click.\nDSE recommendation\nDSE recommends wording the link and run button around the actual operation. Include the intended resource in the description and identify which row or parameter supplies it. Review every dynamic input against the operator’s intended selection. For a destructive request, require the existing change-approval process and an explicit target check; publishing a workbook is not approval to execute its actions.\nVerification\nUse a disposable resource and inspect the resolved request before execution. Compare the displayed target with the endpoint and body, then record the notification and resulting resource state. Repeat with a different row to detect a fixed or incorrectly bound target. Keep the reviewed workbook version with these observations.\nOfficial references\nMicrosoft Learn: Workbook link actions.",
                "datePublished": "2026-09-10T00:31:49+00:00",
                "dateModified": "2026-09-10T00:31:59+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Make a workbook ARM action visibly different from a navigation link"
                },
                "articleSection": [
                    "Cybersecurity",
                    "Networks & Infrastructure"
                ],
                "keywords": [
                    "Cybersecurity",
                    "Networks & Infrastructure",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "Networks & Infrastructure",
                        "url": "https://update.dsesecurity.com/topic/networks-infrastructure/"
                    }
                ],
                "wordCount": 239,
                "timeRequired": "PT2M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Azure Workbooks link actions - Azure Monitor | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions"
                }
            }
        ]
    }
}