Deployment Stacks: Treating Your Azure Deployments Like Actual Assets

Hiya Of us!

In case you have ever come again from trip to discover a “thriller” storage account nobody remembers creating, or watched a junior admin nuke a manufacturing useful resource as a result of they clicked the improper tile within the portal, this session is for you. Sydney Smith from the Azure Deployments crew walked by way of Deployment Stacks on the Microsoft Azure Infrastructure Summit 2026, and the message is easy: traditional Azure deployments are simply historical past information, and historical past information can not defend something.

Deployment Stacks change that. A stack is an actual Azure useful resource. It has a useful resource ID. It helps RBAC. It tracks what it owns. It could actually refuse to let folks break it. That may be a actual improve to how we run Infrastructure as Code in Azure, and IT professionals ought to be paying consideration.

📺 Watch the session:

Let me reduce by way of the noise. Right here is why this issues to anybody operating Azure infrastructure:

• Orphaned sources value actual cash. Traditional deployments don’t monitor possession. Take away a useful resource out of your template, and the dwell useful resource sits in Azure eternally, billing you and including safety threat.
• Deployment historical past is fragile. Anybody can groom it away. You lose the audit path.
• There isn’t any native change safety. With out stacks, the one factor standing between your manufacturing VNet and a midnight portal click on is RBAC self-discipline. That’s not sufficient.
• Drift is invisible. You can’t detect what you can not outline because the supply of reality.
• No unified view. Assets scattered throughout useful resource teams or subscriptions are onerous to handle as one unit.

Stacks provide you with a single lifecycle conscious unit, with inbuilt guardrails, you can govern with RBAC and coverage like every other Azure useful resource. That’s the sort of plumbing IT operations has been asking for.

A deployment stack is a local Azure useful resource that manages a gaggle of sources as one lifecycle conscious unit. It’s the trendy evolution of Azure deployments. The place a traditional deployment is a document of what occurred, a stack is a residing factor that is aware of what it owns.

Key details to anchor on:

• A stack is of sort Microsoft.Assets/deploymentStacks. It’s a top quality Azure useful resource.
• A stack can span a number of useful resource teams and even a number of subscriptions.
• You feed it a Bicep or ARM JSON template, the identical recordsdata you have already got. No rewrite required.
• It produces a snapshot of the sources it manages, and makes use of that snapshot for lifecycle choices.

Two characteristic units do the heavy lifting:

1. Useful resource lifecycle administration. Creates, updates, and deletes throughout scopes are managed as one operation.
2. Useful resource change safety. Stacks can apply deny assignments on the sources they handle, blocking adjustments that didn’t come by way of the stack itself.

That second level is the one which adjustments how you concentrate on security in manufacturing.

Truthfully, the syntax change is tiny. If you realize az deployment group create, you already know az stack group create. Similar template, identical parameter recordsdata, identical scope. You simply swap deployment for stack and add a few new parameters.

What adjustments within the daily:

• Your template turns into the supply of reality. Take away a useful resource from Bicep, and the subsequent stack run can clear it up mechanically. No extra guide hunt and delete.
• You get a portal view. The stack useful resource exhibits you what it manages, what’s indifferent, and what the deny settings appear to be.
• You’ll be able to clear up every little thing in a single step. Deleting a stack with the fitting unmanage setting tears down all its sources and the empty useful resource teams, with out you mapping out dependency order.
• Pipelines get cleaner. The bicep-deploy GitHub Motion and the equal Azure DevOps process communicate stacks natively. Create, validate, what-if, delete. Similar shared package deal on the backend, so options hit GitHub and ADO at roughly the identical time.

The trustworthy tradeoff: stacks are highly effective sufficient to delete issues at scale. That’s the entire level. So you could assume more durable about which mode you decide.

Two parameters carry a lot of the weight, and you could perceive each earlier than you push a stack into manufacturing.

action-on-unmanage controls what occurs when a useful resource leaves the template:

• detachAll: sources keep in Azure, the stack stops monitoring them. That is the default and the most secure. No delete operation. Good if you find yourself nonetheless studying stacks.
• deleteResources: sources are deleted, the useful resource group stays.
• deleteAll: full cleanup. Assets go, empty useful resource teams go. That is what you pair with strict deny settings if you would like the template to be the one supply of reality.

deny-settings-mode controls who can change what:

• none: no safety. Anybody with RBAC can do something. Use this solely if you actually imply it.
• denyDelete: blocks delete operations. Updates are nonetheless allowed.
• denyWriteAndDelete: the strict one. No adjustments exterior the stack. This plus deleteAll makes your template absolutely the supply of reality.

A helpful escape hatch: excludedActions enables you to punch particular useful resource sorts or operations by way of the deny wall. For instance, you may deny delete throughout the board however enable deleting your managed identities or storage accounts. Use this sparingly. Each exception is a future ticket.

A couple of trustworthy tradeoffs to bear in mind:

• denyWriteAndDelete is strict on objective. Portal admins will get permission errors. That’s the characteristic, not a bug. Practice your crew.
• deleteAll is everlasting. Pair it with what-if earlier than each change so you don’t nuke one thing by chance.
• Assets shouldn’t be managed by two stacks. The deny assignments from every stack will battle one another and block updates. If two apps share a SQL database, pull it in as an current useful resource reasonably than twin managing it.
• Stacks should not only for Bicep. They eat ARM JSON templates immediately. Terraform customers don’t get the identical first celebration stack expertise, so in the event you dwell in Terraform world, stacks should not your instrument.

You do not want a large rollout plan. Choose one thing small and be taught the parameters in a secure surroundings.

A sensible path:

1. Choose a non manufacturing Bicep template you already belief. Something that creates a small set of sources in a single useful resource group works.
2. Deploy it as a stack with secure defaults. Use actionOnUnmanage=detachAll and denySettingsMode=denyDelete. You get safety with out risking unintentional deletes.
3. Strive eradicating a useful resource from the template and redeploy. Watch how the useful resource exhibits up as indifferent within the portal. Get snug with what that appears like.
4. Graduate to deletes. If you belief the workflow, swap to deleteResources or deleteAll in a dev surroundings. All the time run what-if first.
5. Undertake Stacks What-If. The newer Stacks What-If commandlet triangulates the stack snapshot, the dwell useful resource state, and the specified state out of your template. The result’s a far much less noisy diff than traditional what-if, and the RBAC mannequin solely wants learn entry on the what-if useful resource for observe up will get. Huge win for manufacturing evaluation workflows.
6. Wire it into your pipeline. The bicep-deploy GitHub Motion and the Azure DevOps process each help sort: deploymentStack with create, validate, and delete operations. Begin with a create pipeline, then add a what-if pipeline for PR validation, then a cleanup pipeline that makes use of delete to tear down ephemeral environments.

If you happen to hit an out of sync error between your stack and Azure, the bypass-stack-out-of-sync-error parameter lets the pipeline reconverge mechanically as a substitute of forcing a guide cleanup. Learn the docs earlier than you flip it on, nevertheless it saves actual time when state drifts.

If this session helped, there are loads extra the place it got here from. The total Microsoft Azure Infrastructure Summit 2026 playlist covers every little thing from Azure Native and Azure Recordsdata to AKS networking, SRE brokers, and the keynote with Jeremy Winter. Value a binge in the event you run Azure infrastructure for a residing.

Microsoft Azure Infrastructure Summit 2026 playlist

Cheers!

Pierre Roman