Choose what happens when a resource leaves an Azure deployment stack

Source facts

Removing a resource from a deployment stack’s template can detach that resource or delete it; the stack’s actionOnUnmanage setting determines the outcome.

Microsoft warns that deleting managed resource groups with deleteAll also deletes everything inside those groups. The impact therefore extends beyond an individual resource removed from a template. Microsoft Learn.

Applicability

Use this review for a stack update or retirement. Identify the stack scope, managed resources, underlying template, and proposed removal behavior. Include group contents in the review whenever a resource group could be deleted.

DSE recommendation

DSE recommends a removal manifest with one intended outcome per resource: retain outside the stack or delete under an approved retirement. Have the workload owner confirm dependencies and data-retention needs. Keep the reviewed template and stack settings together, and reject an unexplained change from retention to deletion. Do not use environment cleanup as implicit approval to remove shared resources.

Verification

Rehearse the exact removal in a disposable stack. Compare the surviving Azure resources with the stack’s managed-resource list, then check the intended retained resource directly. For a group-deletion rehearsal, inventory every child beforehand and reconcile the result afterward. Preserve that evidence before approving the production update.

Official references

Microsoft Learn: Create and deploy Azure deployment stacks in Bicep. Source retrieved September 9, 2026.