Deployment stacks — managed sets of resources, deletion and deny settings
How deployment stacks manage a Bicep deployment as a unit and replace complete mode — az stack group/sub/mg create, actionOnUnmanage (detachAll, deleteResources, deleteAll), deny settings (none, denyDelete, denyWriteAndDelete) and the deny assignments they create, exclusions, the two built-in roles, limits (800 stacks, 2,000 deny assignments), and the known gaps (resource-group deletion bypass, moves, Key Vault secrets, implicit resources).
markdownreferencev146WD-SV5Estage: buildtrust: officialservice: arminterface: cliinterface: iacdeployment stacksaz stack group createaz stack sub createaction-on-unmanagedetachAlldeleteResourcesdeleteAlldeny-settings-modedenyDeletedenyWriteAndDeletedeny-settings-excluded-principalsdeny-settings-excluded-actionsdeny-settings-apply-to-child-scopesAzure Deployment Stack OwnerAzure Deployment Stack ContributormanageDenySetting actiondeployment stack deny assignment 403complete mode replacementbypass-stack-out-of-sync-errorresources-without-delete-support
Deployment stacks
A deployment stack is a resource that remembers which resources a Bicep file created, so an update can delete what you removed from the file and a deny assignment can stop others changing what you deployed. Microsoft recommends stacks over complete mode, which it is gradually deprecating.
Create or update
az stack group create --name orders --resource-group rg-orders \
--template-file main.bicep --parameters main.bicepparam \
--action-on-unmanage detachAll --deny-settings-mode none
az stack sub create --name orders --location eastus2 \
--template-file main.bicep --action-on-unmanage deleteResources \
--deny-settings-mode denyDelete --deny-settings-excluded-principals <pipeline-object-id>Both flags are required on create and update.
--action-on-unmanage | When a resource leaves the file (or the stack is deleted) |
|---|---|
detachAll | Resources and resource groups stay; the stack stops tracking them. Safest default |
deleteResources | Resources are deleted; resource groups are detached |
deleteAll | Resources and resource groups are deleted |
--resources-without-delete-support detach|fail decides what happens to resources the stack can't delete. Key Vault secrets are one: a stack can't delete them, so detach them.
--deny-settings-mode | Blocks for everyone not excluded |
|---|---|
none | Nothing |
denyDelete | Deletes |
denyWriteAndDelete | Updates and deletes |
Exclude your deployment identity with --deny-settings-excluded-principals, or exclude specific operations with --deny-settings-excluded-actions (up to 200). --deny-settings-apply-to-child-scopes extends the deny to child resources (a SQL server's databases). The deny is a deny assignment: it beats any role, which is why a protected resource answers 403 to an Owner (guides/identity/fix-access-denied.md).
Roles
- Azure Deployment Stack Contributor: manage stacks, but not create or delete their deny assignments.
- Azure Deployment Stack Owner: manage stacks including deny assignments.
Enforcement of Microsoft.Resources/deploymentStacks/manageDenySetting/action is rolling out across regions. Expect a Contributor-level identity to fail on deny settings it used to set.
Limits and known gaps
- 800 stacks per scope; 2,000 deny assignments per scope.
- Resources created implicitly by another resource aren't managed: no cleanup, no deny.
- Deny assignments don't support tags, and aren't supported at management-group scope (a management-group stack targeting subscriptions works).
- A resource-group-scope stack doesn't protect its own resource group. Deleting the group deletes everything despite the deny settings. Deploy the stack at subscription scope with the group in the file, or add a lock.
- Moving a managed resource to another group removes its protection. Deny assignments are evaluated at group scope for moves.
--bypass-stack-out-of-sync-error(--bse) exists for when the stack's resource list no longer matches Azure: use it only after checking what changed outside the stack.
Preview
Stack what-if is a separate command, and its result is a resource you name (Microsoft.Resources/deploymentStacksWhatIfResults) that shows what would be created, changed, detached or deleted:
az stack-whatif group create --name orders-preview --resource-group rg-orders \
--stack-id <stack-resource-id> --template-file main.bicep \
--action-on-unmanage deleteResources --deny-settings-mode none --retention-interval PT3H
az stack-whatif group show --name orders-preview --resource-group rg-ordersThe stack doesn't have to exist yet. Run a preview before switching --action-on-unmanage to a delete mode.
Next
Redeploy patterns and known-bad configurations: patterns/bicep-idempotent-redeploy.md.