{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "slug": "dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records", "url": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/" }, "title": "Account for SAS-bearing linked-template URLs in deployment records", "summary": "Do not assume a secure-string parameter keeps a linked template's SAS out of deployment-operation logs.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:29:05+00:00", "modified_at": "2026-09-10T00:55:36+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 223, "potentially_affected": "ARM deployments retrieving externally hosted linked templates through SAS-bearing URLs.", "dse_recommendation": "Review deployment-operation visibility and prefer an appropriate template-spec design where external SAS delivery is unnecessary.", "primary_source": { "name": "Link templates for deployment - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A linked template can be retrieved from private storage using a SAS in its URL. Microsoft warns that the linked-template URI, including that token, is logged in deployment operations even when the token was passed as a secure string.

\n

Microsoft offers template specs as an alternative: the main template and linked templates are packaged as an Azure resource, and access is granted through Azure RBAC rather than an externally accessible template endpoint. Microsoft Learn.

\n

Applicability

\n

Identify every remotely fetched linked template and the authorization embedded in its URI. Review who can read deployment operations and any systems that export or copy those records before choosing a delivery method.

\n

DSE recommendation

\n

DSE recommends assessing template specs for internal template distribution. Where a SAS-based design remains necessary, define a bounded expiration and an owner for its issuance. Keep full token-bearing URLs out of tickets and screenshots, and document the deployment-record exposure instead of describing the secure-string declaration as complete secret protection.

\n

Verification

\n

Use a nonproduction template and a harmless, narrowly scoped test token to inspect the resulting deployment records. Confirm the team knows which fields retain the URI and how access to those records is controlled. For a template-spec alternative, test authorized and unauthorized deployment access and preserve the reviewed resource permissions.

\n

Official references

\n

Microsoft Learn: Link templates for deployment. Source retrieved September 9, 2026.

", "content_text": "Source facts\nA linked template can be retrieved from private storage using a SAS in its URL. Microsoft warns that the linked-template URI, including that token, is logged in deployment operations even when the token was passed as a secure string.\nMicrosoft offers template specs as an alternative: the main template and linked templates are packaged as an Azure resource, and access is granted through Azure RBAC rather than an externally accessible template endpoint. Microsoft Learn.\nApplicability\nIdentify every remotely fetched linked template and the authorization embedded in its URI. Review who can read deployment operations and any systems that export or copy those records before choosing a delivery method.\nDSE recommendation\nDSE recommends assessing template specs for internal template distribution. Where a SAS-based design remains necessary, define a bounded expiration and an owner for its issuance. Keep full token-bearing URLs out of tickets and screenshots, and document the deployment-record exposure instead of describing the secure-string declaration as complete secret protection.\nVerification\nUse a nonproduction template and a harmless, narrowly scoped test token to inspect the resulting deployment records. Confirm the team knows which fields retain the URI and how access to those records is controlled. For a template-spec alternative, test authorized and unauthorized deployment access and preserve the reviewed resource permissions.\nOfficial references\nMicrosoft Learn: Link templates for deployment. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nA linked template can be retrieved from private storage using a SAS in its URL. Microsoft warns that the linked-template URI, including that token, is logged in deployment operations even when the token was passed as a secure string.\n\nMicrosoft offers template specs as an alternative: the main template and linked templates are packaged as an Azure resource, and access is granted through Azure RBAC rather than an externally accessible template endpoint. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates).\n\n## Applicability\n\nIdentify every remotely fetched linked template and the authorization embedded in its URI. Review who can read deployment operations and any systems that export or copy those records before choosing a delivery method.\n\n## DSE recommendation\n\nDSE recommends assessing template specs for internal template distribution. Where a SAS-based design remains necessary, define a bounded expiration and an owner for its issuance. Keep full token-bearing URLs out of tickets and screenshots, and document the deployment-record exposure instead of describing the secure-string declaration as complete secret protection.\n\n## Verification\n\nUse a nonproduction template and a harmless, narrowly scoped test token to inspect the resulting deployment records. Confirm the team knows which fields retain the URI and how access to those records is controlled. For a template-spec alternative, test authorized and unauthorized deployment access and preserve the reviewed resource permissions.\n\n## Official references\n\n[Microsoft Learn: Link templates for deployment](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "url": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Account for SAS-bearing linked-template URLs in deployment records", "item": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "url": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/", "headline": "Account for SAS-bearing linked-template URLs in deployment records", "description": "Do not assume a secure-string parameter keeps a linked template's SAS out of deployment-operation logs.", "abstract": "Do not assume a secure-string parameter keeps a linked template's SAS out of deployment-operation logs.", "articleBody": "Source facts\nA linked template can be retrieved from private storage using a SAS in its URL. Microsoft warns that the linked-template URI, including that token, is logged in deployment operations even when the token was passed as a secure string.\nMicrosoft offers template specs as an alternative: the main template and linked templates are packaged as an Azure resource, and access is granted through Azure RBAC rather than an externally accessible template endpoint. Microsoft Learn.\nApplicability\nIdentify every remotely fetched linked template and the authorization embedded in its URI. Review who can read deployment operations and any systems that export or copy those records before choosing a delivery method.\nDSE recommendation\nDSE recommends assessing template specs for internal template distribution. Where a SAS-based design remains necessary, define a bounded expiration and an owner for its issuance. Keep full token-bearing URLs out of tickets and screenshots, and document the deployment-record exposure instead of describing the secure-string declaration as complete secret protection.\nVerification\nUse a nonproduction template and a harmless, narrowly scoped test token to inspect the resulting deployment records. Confirm the team knows which fields retain the URI and how access to those records is controlled. For a template-spec alternative, test authorized and unauthorized deployment access and preserve the reviewed resource permissions.\nOfficial references\nMicrosoft Learn: Link templates for deployment. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:29:05+00:00", "dateModified": "2026-09-10T00:55:36+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-171-account-for-sas-bearing-linked-template-urls-in-deployment-records/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Account for SAS-bearing linked-template URLs in deployment records" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 223, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Link templates for deployment - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/linked-templates" } } ] } }