# Choose what happens when a resource leaves an Azure deployment stack

> Make removal from a stack an explicit detach-or-delete decision, with special scrutiny for resource-group deletion.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:47+00:00
- Modified: 2026-09-10T00:31:59+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 1 minutes

## What you need to know

Make removal from a stack an explicit detach-or-delete decision, with special scrutiny for resource-group deletion.

## Potentially affected

Azure resources managed by deployment stacks.

## DSE recommendation

Approve the intended detach-or-delete outcome for each removed resource before updating the stack.

## Article

## Source facts

Removing a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.

Microsoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks).

## Applicability

Use this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.

## DSE recommendation

DSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.

## Verification

Rehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.

## Official references

[Microsoft Learn: Create and deploy Azure deployment stacks in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks). Source retrieved September 9, 2026.

## Primary reference

- Name: Create and deploy Azure deployment stacks in Bicep - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose what happens when a resource leaves an Azure deployment stack,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-009-choose-what-happens-when-a-resource-leaves-an-azure-deployment-stack/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.