# Make a workbook ARM action visibly different from a navigation link

> What should a workbook reviewer inspect before exposing a link that executes an ARM request?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:49+00:00
- Modified: 2026-09-10T00:31:59+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

What should a workbook reviewer inspect before exposing a link that executes an ARM request?

## Potentially affected

Azure Monitor workbooks with ARM action links.

## DSE recommendation

Expose the intended target and operation clearly, and inspect the resolved request before enabling an operational workbook action.

## Article

## Source facts

Workbook link actions include both navigation and ARM operations. The ARM action configuration specifies an API path, method, parameters, headers and JSON body; its method choices include POST, PUT, PATCH and DELETE. Parameters and grid-column values can supply request content. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions).

Selecting the link opens a configured run view. The action executes when the user selects its run button. View Request Details exposes the request method and endpoint, while an Azure portal notification reports progress and outcome. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions).

## Applicability

This review concerns Azure Monitor workbooks with ARM action links. Keep it separate from ordinary resource navigation and workbook formatting. Do not describe an action as a harmless detail view merely because both begin with a click.

## DSE recommendation

DSE recommends wording the link and run button around the actual operation. Include the intended resource in the description and identify which row or parameter supplies it. Review every dynamic input against the operator’s intended selection. For a destructive request, require the existing change-approval process and an explicit target check; publishing a workbook is not approval to execute its actions.

## Verification

Use a disposable resource and inspect the resolved request before execution. Compare the displayed target with the endpoint and body, then record the notification and resulting resource state. Repeat with a different row to detect a fixed or incorrectly bound target. Keep the reviewed workbook version with these observations.

## Official references

[Microsoft Learn: Workbook link actions](https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions).

## Primary reference

- Name: Azure Workbooks link actions - Azure Monitor | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-monitor/visualize/workbooks-link-actions
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Make a workbook ARM action visibly different from a navigation link,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-007-make-a-workbook-arm-action-visibly-different-from-a-navigation-link/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.