{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "slug": "dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath", "url": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/" }, "title": "Preserve URI-based deployment for ARM pipeline templates using relativePath", "summary": "Why can switching an ARM pipeline task to a local template break a linked template's relativePath?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:27:48+00:00", "modified_at": "2026-09-10T01:20:46+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "Azure Pipelines ARM deployments whose parent template uses relativePath for a linked template.", "dse_recommendation": "DSE recommends treating the parent template's retrieval mode as part of the linked-template dependency.", "primary_source": { "name": "Continuous integration with Azure Pipelines - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

In Microsoft’s ARM pipeline example, relativePath is supported only for URI-based deployments, so the parent template must be supplied through the task’s file-URL option. The pipeline also depends on the repository folder and template file names; renaming them requires corresponding pipeline updates. A downloaded parent file is not automatically an equivalent input for this addressing model. Microsoft Learn.

\n

Applicability

\n

Use this check when refactoring the pipeline’s artifact handling or repository layout. Determine whether the parent uses relativePath before replacing its URL with a checked-out local file. Keep this path-resolution question separate from the identity used to authorize deployment.

\n

DSE recommendation

\n

DSE recommends treating the parent template’s retrieval mode as part of the linked-template dependency. Record the parent location, linked file and repository layout together. If a new delivery mechanism is required, review a supported redesign of the link instead of silently changing only the task’s template-location setting. Use approved artifact access controls and do not place credentials into general build logs.

\n

Verification

\n

In a test pipeline, deploy the intended parent and confirm that its linked resource is actually created with the expected configuration. Repeat after a proposed rename or delivery-mode change. Retain the precise artifact revisions and task settings used for the successful run. A job that finds its parent template has not, by that fact alone, proved that the child reference resolves correctly.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nIn Microsoft’s ARM pipeline example, relativePath is supported only for URI-based deployments, so the parent template must be supplied through the task’s file-URL option. The pipeline also depends on the repository folder and template file names; renaming them requires corresponding pipeline updates. A downloaded parent file is not automatically an equivalent input for this addressing model. Microsoft Learn.\nApplicability\nUse this check when refactoring the pipeline’s artifact handling or repository layout. Determine whether the parent uses relativePath before replacing its URL with a checked-out local file. Keep this path-resolution question separate from the identity used to authorize deployment.\nDSE recommendation\nDSE recommends treating the parent template’s retrieval mode as part of the linked-template dependency. Record the parent location, linked file and repository layout together. If a new delivery mechanism is required, review a supported redesign of the link instead of silently changing only the task’s template-location setting. Use approved artifact access controls and do not place credentials into general build logs.\nVerification\nIn a test pipeline, deploy the intended parent and confirm that its linked resource is actually created with the expected configuration. Repeat after a proposed rename or delivery-mode change. Retain the precise artifact revisions and task settings used for the successful run. A job that finds its parent template has not, by that fact alone, proved that the child reference resolves correctly.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nIn Microsoft’s ARM pipeline example, relativePath is supported only for URI-based deployments, so the parent template must be supplied through the task’s file-URL option. The pipeline also depends on the repository folder and template file names; renaming them requires corresponding pipeline updates. A downloaded parent file is not automatically an equivalent input for this addressing model. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline).\n\n## Applicability\n\nUse this check when refactoring the pipeline’s artifact handling or repository layout. Determine whether the parent uses relativePath before replacing its URL with a checked-out local file. Keep this path-resolution question separate from the identity used to authorize deployment.\n\n## DSE recommendation\n\nDSE recommends treating the parent template’s retrieval mode as part of the linked-template dependency. Record the parent location, linked file and repository layout together. If a new delivery mechanism is required, review a supported redesign of the link instead of silently changing only the task’s template-location setting. Use approved artifact access controls and do not place credentials into general build logs.\n\n## Verification\n\nIn a test pipeline, deploy the intended parent and confirm that its linked resource is actually created with the expected configuration. Repeat after a proposed rename or delivery-mode change. Retain the precise artifact revisions and task settings used for the successful run. A job that finds its parent template has not, by that fact alone, proved that the child reference resolves correctly.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "url": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve URI-based deployment for ARM pipeline templates using relativePath", "item": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "url": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/", "headline": "Preserve URI-based deployment for ARM pipeline templates using relativePath", "description": "Why can switching an ARM pipeline task to a local template break a linked template's relativePath?", "abstract": "Why can switching an ARM pipeline task to a local template break a linked template's relativePath?", "articleBody": "Source facts\nIn Microsoft’s ARM pipeline example, relativePath is supported only for URI-based deployments, so the parent template must be supplied through the task’s file-URL option. The pipeline also depends on the repository folder and template file names; renaming them requires corresponding pipeline updates. A downloaded parent file is not automatically an equivalent input for this addressing model. Microsoft Learn.\nApplicability\nUse this check when refactoring the pipeline’s artifact handling or repository layout. Determine whether the parent uses relativePath before replacing its URL with a checked-out local file. Keep this path-resolution question separate from the identity used to authorize deployment.\nDSE recommendation\nDSE recommends treating the parent template’s retrieval mode as part of the linked-template dependency. Record the parent location, linked file and repository layout together. If a new delivery mechanism is required, review a supported redesign of the link instead of silently changing only the task’s template-location setting. Use approved artifact access controls and do not place credentials into general build logs.\nVerification\nIn a test pipeline, deploy the intended parent and confirm that its linked resource is actually created with the expected configuration. Repeat after a proposed rename or delivery-mode change. Retain the precise artifact revisions and task settings used for the successful run. A job that finds its parent template has not, by that fact alone, proved that the child reference resolves correctly.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:27:48+00:00", "dateModified": "2026-09-10T01:20:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve URI-based deployment for ARM pipeline templates using relativePath" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Continuous integration with Azure Pipelines - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline" } } ] } }