# Preserve URI-based deployment for ARM pipeline templates using relativePath

> Why can switching an ARM pipeline task to a local template break a linked template's relativePath?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:27:48+00:00
- Modified: 2026-09-10T01:20:46+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Why can switching an ARM pipeline task to a local template break a linked template's relativePath?

## Potentially affected

Azure Pipelines ARM deployments whose parent template uses relativePath for a linked template.

## DSE recommendation

DSE recommends treating the parent template's retrieval mode as part of the linked-template dependency.

## Article

## Source facts

In Microsoft’s ARM pipeline example, relativePath is supported only for URI-based deployments, so the parent template must be supplied through the task’s file-URL option. The pipeline also depends on the repository folder and template file names; renaming them requires corresponding pipeline updates. A downloaded parent file is not automatically an equivalent input for this addressing model. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline).

## Applicability

Use this check when refactoring the pipeline’s artifact handling or repository layout. Determine whether the parent uses relativePath before replacing its URL with a checked-out local file. Keep this path-resolution question separate from the identity used to authorize deployment.

## DSE recommendation

DSE recommends treating the parent template’s retrieval mode as part of the linked-template dependency. Record the parent location, linked file and repository layout together. If a new delivery mechanism is required, review a supported redesign of the link instead of silently changing only the task’s template-location setting. Use approved artifact access controls and do not place credentials into general build logs.

## Verification

In a test pipeline, deploy the intended parent and confirm that its linked resource is actually created with the expected configuration. Repeat after a proposed rename or delivery-mode change. Retain the precise artifact revisions and task settings used for the successful run. A job that finds its parent template has not, by that fact alone, proved that the child reference resolves correctly.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline). Source retrieved September 9, 2026.

## Primary reference

- Name: Continuous integration with Azure Pipelines - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deployment-tutorial-pipeline
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve URI-based deployment for ARM pipeline templates using relativePath,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-248-preserve-uri-based-deployment-for-arm-pipeline-templates-using-relativepath/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.