# Choose deployment-script cleanup without losing the failure investigation plan

> Review supporting-resource cleanup and retained script output separately when configuring a Bicep deployment script.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:29:51+00:00
- Modified: 2026-09-10T00:52:38+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Review supporting-resource cleanup and retained script output separately when configuring a Bicep deployment script.

## Potentially affected

Azure deployment scripts authored in Bicep.

## DSE recommendation

Choose cleanup behavior deliberately and keep sensitive values out of script output under either setting.

## Article

## Source facts

For deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.

Script logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop).

## Applicability

Identify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.

## DSE recommendation

DSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.

## Verification

Run a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.

## Official references

[Microsoft Learn: Develop a deployment script in Bicep](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop). Source retrieved September 9, 2026.

## Primary reference

- Name: Develop a deployment script in Bicep - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-script-develop
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Choose deployment-script cleanup without losing the failure investigation plan,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-125-choose-deployment-script-cleanup-without-losing-the-failure-investigation-plan/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.