Choose deployment-script cleanup without losing the failure investigation plan

Source facts

For deployment scripts, Always removes supporting resources after execution reaches a terminal state. OnSuccess cleans up after success; after failure, cleanup waits for retentionInterval to expire. With existing storage, the corresponding cleanup concerns the service-created file share. Microsoft retains execution results before those supporting resources are deleted.

Script logs can contain standard output, standard error, and messages written through commands such as Write-Host or echo. Microsoft warns authors not to place tokens, credentials, or other secrets in that output. Microsoft Learn.

Applicability

Identify the script’s selected cleanup behavior, whether it uses existing storage, and how operators obtain its failure evidence. Do not treat removal of supporting infrastructure as evidence that sensitive output was never recorded.

DSE recommendation

DSE recommends choosing the cleanup setting alongside the troubleshooting plan. Specify who can inspect failed runs, what output is permitted, and how supporting resources will be accounted for. Review each diagnostic message before deployment; prefer identifiers and bounded error descriptions over credential-bearing request dumps. Keep shared operational workloads out of service-generated support resources.

Verification

Run a controlled success and a controlled failure with harmless test output. Compare resource cleanup, retained results, and the operator’s ability to investigate. Inspect both output streams for accidental sensitive values. Record the actual cleanup outcome and any remaining resources for follow-up; do not test with live credentials as sample data.

Official references

Microsoft Learn: Develop a deployment script in Bicep. Source retrieved September 9, 2026.