{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "slug": "dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store", "url": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/" }, "title": "Distinguish a managed-application package URL from its BYOS definition store", "summary": "Which storage location retains the managed-application definition after a BYOS publication?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:46+00:00", "modified_at": "2026-09-10T00:31:59+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 242, "potentially_affected": "Azure Managed Applications service-catalog definitions using bring-your-own storage.", "dse_recommendation": "DSE recommends recording both locations and the writer identity before publication.", "primary_source": { "name": "Bring your own storage to create and publish an Azure Managed Application definition - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In a managed-application BYOS definition, packageFileUri identifies the input ZIP, while storageAccountId identifies the account used to retain definition files. Deployment creates an applicationdefinitions container there and copies the package’s files into it. Microsoft requires the Appliance Resource Provider identity to have Contributor at that storage account so it can write those files. BYOS definition deployment supports ARM templates or REST. Microsoft Learn.

\n

Applicability

\n

Managed Applications accepts ARM languageVersion 1.0, not 2.0. Microsoft Learn.

\n

Identify the package source and the definition-storage destination as separate roles, even if a design places them close together. This review concerns definition publication, not the later application’s runtime storage or the publisher’s access to a customer’s managed resource group.

\n

DSE recommendation

\n

DSE recommends recording both locations and the writer identity before publication. Have the storage owner verify the destination account and scoped role assignment, and compare the package URL against the approved release artifact. Review the complete supported deployment path rather than substituting a source URL for the destination account identifier. Keep storage-security changes under their own approval.

\n

Verification

\n

After an approved definition deployment, inspect the destination account’s applicationdefinitions container and confirm the expected definition files are present. Compare that evidence with the input archive and publication record. Verify the intended reader can access the definition separately from the service identity’s write access. Do not report a successful upload to the package-source container as proof that BYOS definition publication completed.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nIn a managed-application BYOS definition, packageFileUri identifies the input ZIP, while storageAccountId identifies the account used to retain definition files. Deployment creates an applicationdefinitions container there and copies the package’s files into it. Microsoft requires the Appliance Resource Provider identity to have Contributor at that storage account so it can write those files. BYOS definition deployment supports ARM templates or REST. Microsoft Learn.\nApplicability\nManaged Applications accepts ARM languageVersion 1.0, not 2.0. Microsoft Learn.\nIdentify the package source and the definition-storage destination as separate roles, even if a design places them close together. This review concerns definition publication, not the later application’s runtime storage or the publisher’s access to a customer’s managed resource group.\nDSE recommendation\nDSE recommends recording both locations and the writer identity before publication. Have the storage owner verify the destination account and scoped role assignment, and compare the package URL against the approved release artifact. Review the complete supported deployment path rather than substituting a source URL for the destination account identifier. Keep storage-security changes under their own approval.\nVerification\nAfter an approved definition deployment, inspect the destination account’s applicationdefinitions container and confirm the expected definition files are present. Compare that evidence with the input archive and publication record. Verify the intended reader can access the definition separately from the service identity’s write access. Do not report a successful upload to the package-source container as proof that BYOS definition publication completed.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nIn a managed-application BYOS definition, packageFileUri identifies the input ZIP, while storageAccountId identifies the account used to retain definition files. Deployment creates an applicationdefinitions container there and copies the package’s files into it. Microsoft requires the Appliance Resource Provider identity to have Contributor at that storage account so it can write those files. BYOS definition deployment supports ARM templates or REST. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage).\n\n## Applicability\n\nManaged Applications accepts ARM languageVersion 1.0, not 2.0. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage).\n\nIdentify the package source and the definition-storage destination as separate roles, even if a design places them close together. This review concerns definition publication, not the later application’s runtime storage or the publisher’s access to a customer’s managed resource group.\n\n## DSE recommendation\n\nDSE recommends recording both locations and the writer identity before publication. Have the storage owner verify the destination account and scoped role assignment, and compare the package URL against the approved release artifact. Review the complete supported deployment path rather than substituting a source URL for the destination account identifier. Keep storage-security changes under their own approval.\n\n## Verification\n\nAfter an approved definition deployment, inspect the destination account’s applicationdefinitions container and confirm the expected definition files are present. Compare that evidence with the input archive and publication record. Verify the intended reader can access the definition separately from the service identity’s write access. Do not report a successful upload to the package-source container as proof that BYOS definition publication completed.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "url": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Distinguish a managed-application package URL from its BYOS definition store", "item": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "url": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/", "headline": "Distinguish a managed-application package URL from its BYOS definition store", "description": "Which storage location retains the managed-application definition after a BYOS publication?", "abstract": "Which storage location retains the managed-application definition after a BYOS publication?", "articleBody": "Source facts\nIn a managed-application BYOS definition, packageFileUri identifies the input ZIP, while storageAccountId identifies the account used to retain definition files. Deployment creates an applicationdefinitions container there and copies the package’s files into it. Microsoft requires the Appliance Resource Provider identity to have Contributor at that storage account so it can write those files. BYOS definition deployment supports ARM templates or REST. Microsoft Learn.\nApplicability\nManaged Applications accepts ARM languageVersion 1.0, not 2.0. Microsoft Learn.\nIdentify the package source and the definition-storage destination as separate roles, even if a design places them close together. This review concerns definition publication, not the later application’s runtime storage or the publisher’s access to a customer’s managed resource group.\nDSE recommendation\nDSE recommends recording both locations and the writer identity before publication. Have the storage owner verify the destination account and scoped role assignment, and compare the package URL against the approved release artifact. Review the complete supported deployment path rather than substituting a source URL for the destination account identifier. Keep storage-security changes under their own approval.\nVerification\nAfter an approved definition deployment, inspect the destination account’s applicationdefinitions container and confirm the expected definition files are present. Compare that evidence with the input archive and publication record. Verify the intended reader can access the definition separately from the service identity’s write access. Do not report a successful upload to the package-source container as proof that BYOS definition publication completed.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:31:46+00:00", "dateModified": "2026-09-10T00:31:59+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-010-distinguish-a-managed-application-package-url-from-its-byos-definition-store/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Distinguish a managed-application package URL from its BYOS definition store" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 242, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Bring your own storage to create and publish an Azure Managed Application definition - Azure Managed Applications | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/managed-applications/publish-service-catalog-bring-your-own-storage" } } ] } }