{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "slug": "dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan", "url": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/" }, "title": "Choose deployment-script cleanup without losing the failure investigation plan", "summary": "Review supporting-resource cleanup and retained script output separately when configuring a Bicep deployment script.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:51+00:00", "modified_at": "2026-09-10T00:52:38+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 237, "potentially_affected": "Azure deployment scripts authored in Bicep.", "dse_recommendation": "Choose cleanup behavior deliberately and keep sensitive values out of script output under either setting.", "primary_source": { "name": "Develop a deployment script in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.

\n

Script logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. Microsoft Learn.

\n

Applicability

\n

Identify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.

\n

DSE recommendation

\n

DSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.

\n

Verification

\n

Run a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.

\n

Official references

\n

Microsoft Learn: Develop a deployment script in Bicep. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.\nScript logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. Microsoft Learn.\nApplicability\nIdentify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.\nDSE recommendation\nDSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.\nVerification\nRun a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.\nOfficial references\nMicrosoft Learn: Develop a deployment script in Bicep. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.\n\nScript logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop).\n\n## Applicability\n\nIdentify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.\n\n## DSE recommendation\n\nDSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.\n\n## Verification\n\nRun a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.\n\n## Official references\n\n[Microsoft Learn: Develop a deployment script in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "url": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Choose deployment-script cleanup without losing the failure investigation plan", "item": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "url": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/", "headline": "Choose deployment-script cleanup without losing the failure investigation plan", "description": "Review supporting-resource cleanup and retained script output separately when configuring a Bicep deployment script.", "abstract": "Review supporting-resource cleanup and retained script output separately when configuring a Bicep deployment script.", "articleBody": "Source facts\nFor deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.\nScript logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. Microsoft Learn.\nApplicability\nIdentify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.\nDSE recommendation\nDSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.\nVerification\nRun a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.\nOfficial references\nMicrosoft Learn: Develop a deployment script in Bicep. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:51+00:00", "dateModified": "2026-09-10T00:52:38+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Choose deployment-script cleanup without losing the failure investigation plan" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 237, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Develop a deployment script in Bicep - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop" } } ] } }