Distinguish a managed-application package URL from its BYOS definition store

Source facts

In a managed-application BYOS definition, packageFileUri identifies the input ZIP, while storageAccountId identifies the account used to retain definition files. Deployment creates an applicationdefinitions container there and copies the package’s files into it. Microsoft requires the Appliance Resource Provider identity to have Contributor at that storage account so it can write those files. BYOS definition deployment supports ARM templates or REST. Microsoft Learn.

Applicability

Managed Applications accepts ARM languageVersion 1.0, not 2.0. Microsoft Learn.

Identify the package source and the definition-storage destination as separate roles, even if a design places them close together. This review concerns definition publication, not the later application’s runtime storage or the publisher’s access to a customer’s managed resource group.

DSE recommendation

DSE recommends recording both locations and the writer identity before publication. Have the storage owner verify the destination account and scoped role assignment, and compare the package URL against the approved release artifact. Review the complete supported deployment path rather than substituting a source URL for the destination account identifier. Keep storage-security changes under their own approval.

Verification

After an approved definition deployment, inspect the destination account’s applicationdefinitions container and confirm the expected definition files are present. Compare that evidence with the input archive and publication record. Verify the intended reader can access the definition separately from the service identity’s write access. Do not report a successful upload to the package-source container as proof that BYOS definition publication completed.

Official references

Microsoft Learn. Source retrieved September 9, 2026.