Bicep Deployment Stacks

A deployment stack manages a group of resources as one unit. Azure remembers every resource that a stack created, so updates, protection, and cleanup apply to the whole group. A normal deployment forgets its resources the moment it finishes.

Picture a shopping cart. Items go into the cart, and the cart knows its contents. Removing an item from the list removes it from the cart, and emptying the cart clears everything. A stack tracks resources the same way.

Normal Deployment vs Stack

  Normal deployment                     Deployment stack
  ─────────────────                     ────────────────
  Template ──► Resources                Template ──► Resources
  (link ends after the run)             (stack keeps the list)
  Deleted line in template              Deleted line in template
     = resource stays behind              = resource is detached or deleted,
                                            as the stack setting says

Create a Stack

The az stack group create command deploys a Bicep file into a resource group and records the result as a stack.

az stack group create \
  --name stack-shop \
  --resource-group rg-shop-dev \
  --template-file main.bicep \
  --action-on-unmanage deleteResources \
  --deny-settings-mode denyDelete

Stacks exist at subscription and management group levels through az stack sub and az stack mg.

The action-on-unmanage Setting

An unmanaged resource once belonged to the stack and no longer appears in the template. The setting decides its fate.

Value	Result for Removed Resources
detachAll	Resources stay in Azure, and the stack forgets them
deleteResources	Azure deletes the resources and keeps the resource groups
deleteAll	Azure deletes resources and resource groups

Start with detachAll while learning. Deleting settings demand care, and a what-if preview or a test group helps first.

Deny Settings

Deny settings block outside changes to managed resources. A teammate who clicks delete in the portal receives a refusal.

Mode	Protection
none	No protection
denyDelete	Blocks deletion
denyWriteAndDelete	Blocks edits and deletion

Updates through the stack still work, so the template remains the single path for change.

Update a Stack

Run the create command again with the changed template. Azure adds new resources, updates edited ones, and applies the unmanage action to anything removed.

Inspect a Stack

az stack group show \
  --name stack-shop \
  --resource-group rg-shop-dev

The output lists every managed resource and the stack settings.

Clean Up with One Command

Deleting a stack with a delete action removes every resource it manages.

az stack group delete \
  --name stack-shop \
  --resource-group rg-shop-dev \
  --action-on-unmanage deleteAll

Test and demo environments benefit most. A single command ends an experiment and leaves nothing behind to bill.

Good Uses

Temporary Environments

Short-lived test setups disappear cleanly when the stack goes.

Protected Production

Deny settings stop accidental portal edits and keep production aligned with source control.

Tidy Template Cleanup

Removing a resource from the template removes it from Azure, which prevents forgotten leftovers.

Stacks and Source Control

A stack pairs well with a Git repository. The template in the repository describes the desired state, and the stack enforces it in Azure. A pull request that removes a resource leads to its removal after the pipeline runs, which keeps the repository and the cloud in agreement.

Summary

Deployment stacks track the resources that a template creates. The action-on-unmanage setting decides what happens to removed resources, and deny settings protect managed resources from outside changes. One delete command clears an entire stack, which suits temporary environments and tightly controlled production setups.