Deployment Stacks: Treating Your Azure Deployments Like Actual Sources

Whats up Of us!

If in case you have ever come again from trip to discover a “thriller” storage account nobody remembers creating, or watched a junior admin nuke a manufacturing useful resource as a result of they clicked the incorrect tile within the portal, this session is for you. Sydney Smith from the Azure Deployments group walked by way of Deployment Stacks on the Microsoft Azure Infrastructure Summit 2026, and the message is easy: basic Azure deployments are simply historical past information, and historical past information can not shield something.

Deployment Stacks change that. A stack is an actual Azure useful resource. It has a useful resource ID. It helps RBAC. It tracks what it owns. It could actually refuse to let folks break it. That may be a actual improve to how we run Infrastructure as Code in Azure, and IT professionals must be paying consideration.

📺 Watch the session:

Let me lower by way of the noise. Right here is why this issues to anybody operating Azure infrastructure:

• Orphaned assets value actual cash. Basic deployments don’t monitor possession. Take away a useful resource out of your template, and the reside useful resource sits in Azure endlessly, billing you and including safety threat.
• Deployment historical past is fragile. Anybody can groom it away. You lose the audit path.
• There isn’t any native change safety. With out stacks, the one factor standing between your manufacturing VNet and a midnight portal click on is RBAC self-discipline. That isn’t sufficient.
• Drift is invisible. You can not detect what you can not outline because the supply of reality.
• No unified view. Sources scattered throughout useful resource teams or subscriptions are laborious to handle as one unit.

Stacks offer you a single lifecycle conscious unit, with inbuilt guardrails, that you could govern with RBAC and coverage like another Azure useful resource. That’s the sort of plumbing IT operations has been asking for.

A deployment stack is a local Azure useful resource that manages a gaggle of assets as one lifecycle conscious unit. It’s the trendy evolution of Azure deployments. The place a basic deployment is a document of what occurred, a stack is a dwelling factor that is aware of what it owns.

Key info to anchor on:

• A stack is of kind Microsoft.Sources/deploymentStacks. It’s a top notch Azure useful resource.
• A stack can span a number of useful resource teams and even a number of subscriptions.
• You feed it a Bicep or ARM JSON template, the identical recordsdata you have already got. No rewrite required.
• It produces a snapshot of the assets it manages, and makes use of that snapshot for lifecycle choices.

Two characteristic units do the heavy lifting:

1. Useful resource lifecycle administration. Creates, updates, and deletes throughout scopes are managed as one operation.
2. Useful resource change safety. Stacks can apply deny assignments on the assets they handle, blocking adjustments that didn’t come by way of the stack itself.

That second level is the one which adjustments how you concentrate on security in manufacturing.

Actually, the syntax change is tiny. If az deployment group create, you already know az stack group create. Similar template, identical parameter recordsdata, identical scope. You simply swap deployment for stack and add a few new parameters.

What adjustments within the each day:

• Your template turns into the supply of reality. Take away a useful resource from Bicep, and the subsequent stack run can clear it up routinely. No extra handbook hunt and delete.
• You get a portal view. The stack useful resource reveals you what it manages, what’s indifferent, and what the deny settings seem like.
• You may clear up every little thing in a single step. Deleting a stack with the proper unmanage setting tears down all its assets and the empty useful resource teams, with out you mapping out dependency order.
• Pipelines get cleaner. The bicep-deploy GitHub Motion and the equal Azure DevOps process converse stacks natively. Create, validate, what-if, delete. Similar shared bundle on the backend, so options hit GitHub and ADO at roughly the identical time.

The sincere tradeoff: stacks are highly effective sufficient to delete issues at scale. That’s the entire level. So you could assume tougher about which mode you decide.

Two parameters carry a lot of the weight, and you could perceive each earlier than you push a stack into manufacturing.

action-on-unmanage controls what occurs when a useful resource leaves the template:

• detachAll: assets keep in Azure, the stack stops monitoring them. That is the default and the most secure. No delete operation. Good if you end up nonetheless studying stacks.
• deleteResources: assets are deleted, the useful resource group stays.
• deleteAll: full cleanup. Sources go, empty useful resource teams go. That is what you pair with strict deny settings in order for you the template to be the one supply of reality.

deny-settings-mode controls who can change what:

• none: no safety. Anybody with RBAC can do something. Use this solely whenever you actually imply it.
• denyDelete: blocks delete operations. Updates are nonetheless allowed.
• denyWriteAndDelete: the strict one. No adjustments exterior the stack. This plus deleteAll makes your template absolutely the supply of reality.

A helpful escape hatch: excludedActions permits you to punch particular useful resource varieties or operations by way of the deny wall. For instance, you’ll be able to deny delete throughout the board however enable deleting your managed identities or storage accounts. Use this sparingly. Each exception is a future ticket.

A number of sincere tradeoffs to bear in mind:

• denyWriteAndDelete is strict on function. Portal admins will get permission errors. That’s the characteristic, not a bug. Prepare your group.
• deleteAll is everlasting. Pair it with what-if earlier than each change so you don’t nuke one thing accidentally.
• Sources shouldn’t be managed by two stacks. The deny assignments from every stack will struggle one another and block updates. If two apps share a SQL database, pull it in as an present useful resource moderately than twin managing it.
• Stacks will not be only for Bicep. They eat ARM JSON templates immediately. Terraform customers don’t get the identical first social gathering stack expertise, so when you reside in Terraform world, stacks will not be your device.

You do not want an enormous rollout plan. Decide one thing small and study the parameters in a secure atmosphere.

A sensible path:

1. Decide a non manufacturing Bicep template you already belief. Something that creates a small set of assets in a single useful resource group works.
2. Deploy it as a stack with secure defaults. Use actionOnUnmanage=detachAll and denySettingsMode=denyDelete. You get safety with out risking unintended deletes.
3. Attempt eradicating a useful resource from the template and redeploy. Watch how the useful resource reveals up as indifferent within the portal. Get comfy with what that appears like.
4. Graduate to deletes. Whenever you belief the workflow, swap to deleteResources or deleteAll in a dev atmosphere. At all times run what-if first.
5. Undertake Stacks What-If. The newer Stacks What-If commandlet triangulates the stack snapshot, the reside useful resource state, and the specified state out of your template. The result’s a far much less noisy diff than basic what-if, and the RBAC mannequin solely wants learn entry on the what-if useful resource for comply with up will get. Large win for manufacturing evaluation workflows.
6. Wire it into your pipeline. The bicep-deploy GitHub Motion and the Azure DevOps process each assist kind: deploymentStack with create, validate, and delete operations. Begin with a create pipeline, then add a what-if pipeline for PR validation, then a cleanup pipeline that makes use of delete to tear down ephemeral environments.

In case you hit an out of sync error between your stack and Azure, the bypass-stack-out-of-sync-error parameter lets the pipeline reconverge routinely as a substitute of forcing a handbook cleanup. Learn the docs earlier than you flip it on, nevertheless it saves actual time when state drifts.

If this session helped, there are lots extra the place it got here from. The complete Microsoft Azure Infrastructure Summit 2026 playlist covers every little thing from Azure Native and Azure Recordsdata to AKS networking, SRE brokers, and the keynote with Jeremy Winter. Price a binge when you run Azure infrastructure for a dwelling.

Microsoft Azure Infrastructure Summit 2026 playlist

Cheers!

Pierre Roman