Account for SAS-bearing linked-template URLs in deployment records

Source facts

A linked template can be retrieved from private storage using a SAS in its URL. Microsoft warns that the linked-template URI, including that token, is logged in deployment operations even when the token was passed as a secure string.

Microsoft offers template specs as an alternative: the main template and linked templates are packaged as an Azure resource, and access is granted through Azure RBAC rather than an externally accessible template endpoint. Microsoft Learn.

Applicability

Identify every remotely fetched linked template and the authorization embedded in its URI. Review who can read deployment operations and any systems that export or copy those records before choosing a delivery method.

DSE recommendation

DSE recommends assessing template specs for internal template distribution. Where a SAS-based design remains necessary, define a bounded expiration and an owner for its issuance. Keep full token-bearing URLs out of tickets and screenshots, and document the deployment-record exposure instead of describing the secure-string declaration as complete secret protection.

Verification

Use a nonproduction template and a harmless, narrowly scoped test token to inspect the resulting deployment records. Confirm the team knows which fields retain the URI and how access to those records is controlled. For a template-spec alternative, test authorized and unauthorized deployment access and preserve the reviewed resource permissions.

Official references

Microsoft Learn: Link templates for deployment. Source retrieved September 9, 2026.