# Give deployment-stack what-if result resources an explicit retention owner

> Stack previews do not alter existing resources, but their stored result is a separate resource that counts against scope limits.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-524-give-deployment-stack-what-if-result-resources-an-explicit-retention-owner/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:12+00:00
- Modified: 2026-09-10T02:11:18+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Stack previews do not alter existing resources, but their stored result is a separate resource that counts against scope limits.

## Potentially affected

Automation creating stored Azure deployment-stack what-if results.

## DSE recommendation

Track the result resource separately from the stack and choose a deliberate retention and cleanup policy.

## Article

## Source facts

Deployment-stack what-if previews changes without modifying existing resources. It creates a separate Microsoft.Resources/deploymentStacksWhatIfResults resource that references the stack, has its own name and can be retrieved or deleted independently.

Stored results count toward resource limits at their scope. Microsoft recommends a retention interval of PT3H or less; results configured for longer intervals are not automatically deleted and require explicit cleanup when no longer needed. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks-what-if).

## Applicability

Identify the stack, result-resource scope, intended audit retention and frequency of preview runs. Keep a result’s identifier separate from the stack identifier so retention operations cannot target the wrong object.

## DSE recommendation

DSE recommends assigning ownership for preview evidence and its lifecycle in the deployment workflow. Retain the result needed to support an approval according to the organization’s evidence policy, and define safe cleanup of obsolete result resources. Do not describe preview execution as leaving no managed artifact merely because the proposed resource changes were not applied.

## Verification

Run an approved preview and inspect the named result resource, its referenced stack and retention interval. Confirm the workflow can retrieve the intended evidence and that any cleanup action targets only approved result resources. For a longer retention choice, verify explicit cleanup handling rather than assuming the interval guarantees deletion. Preserve the approval linkage before removing material evidence.

## Official references

[Microsoft Learn: Preview deployment stack changes with what-if](https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks-what-if). Source retrieved September 9, 2026.

## Primary reference

- Name: Preview deployment stack changes with what-if - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/deployment-stacks-what-if
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Give deployment-stack what-if result resources an explicit retention owner,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-524-give-deployment-stack-what-if-result-resources-an-explicit-retention-owner/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.