{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "slug": "dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack", "url": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/" }, "title": "Choose what happens when a resource leaves an Azure deployment stack", "summary": "Make removal from a stack an explicit detach-or-delete decision, with special scrutiny for resource-group deletion.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:47+00:00", "modified_at": "2026-09-10T00:31:59+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 1, "word_count": 211, "potentially_affected": "Azure resources managed by deployment stacks.", "dse_recommendation": "Approve the intended detach-or-delete outcome for each removed resource before updating the stack.", "primary_source": { "name": "Create and deploy Azure deployment stacks in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Removing a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.

\n

Microsoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. Microsoft Learn.

\n

Applicability

\n

Use this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.

\n

DSE recommendation

\n

DSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.

\n

Verification

\n

Rehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.

\n

Official references

\n

Microsoft Learn: Create and deploy Azure deployment stacks in Bicep. Source retrieved September 9, 2026.

", "content_text": "Source facts\nRemoving a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.\nMicrosoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. Microsoft Learn.\nApplicability\nUse this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.\nDSE recommendation\nDSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.\nVerification\nRehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.\nOfficial references\nMicrosoft Learn: Create and deploy Azure deployment stacks in Bicep. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nRemoving a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.\n\nMicrosoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks).\n\n## Applicability\n\nUse this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.\n\n## DSE recommendation\n\nDSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.\n\n## Verification\n\nRehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.\n\n## Official references\n\n[Microsoft Learn: Create and deploy Azure deployment stacks in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "url": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose what happens when a resource leaves an Azure deployment stack", "item": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "url": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/", "headline": "Choose what happens when a resource leaves an Azure deployment stack", "description": "Make removal from a stack an explicit detach-or-delete decision, with special scrutiny for resource-group deletion.", "abstract": "Make removal from a stack an explicit detach-or-delete decision, with special scrutiny for resource-group deletion.", "articleBody": "Source facts\nRemoving a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.\nMicrosoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. Microsoft Learn.\nApplicability\nUse this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.\nDSE recommendation\nDSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.\nVerification\nRehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.\nOfficial references\nMicrosoft Learn: Create and deploy Azure deployment stacks in Bicep. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:31:47+00:00", "dateModified": "2026-09-10T00:31:59+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose what happens when a resource leaves an Azure deployment stack" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 211, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create and deploy Azure deployment stacks in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks" } } ] } }