An Azure deployment stack is a resource that lets you manage a group of Azure resources as a single, cohesive unit. When you submit a Bicep file or an ARM JSON template to a deployment stack, it defines the resources the stack manages. Previously, classic ARM deployments could not automatically remove resources no longer present in the template definition, and there was no built-in protection against external changes to IaC-managed resources. Deployment Stacks close this gap.
Deployment Stacks as Atomic Resource Units
A Deployment Stack groups all resources of an ARM or Bicep deployment into a managed unit. When a resource is removed from the template and the stack is updated, the resource can be deleted or placed into a “detached” state, depending on the configured actionOnUnmanage behavior (the default behavior is detach, not delete). Stacks can be created at resource group, subscription, or management group scope; for example, a stack at subscription scope can manage resources in a different resource group.
The core feature for governance-sensitive environments is DenySettings. With DenyDelete, a stack prevents managed resources from being deleted outside the IaC workflow. DenyWriteAndDelete additionally blocks external configuration changes. Selected roles or principals can be excluded from these restrictions. This keeps the IaC code as the primary source for configuration changes and reduces “config drift” caused by manual interventions. Important: DenySettings only apply to control-plane operations, not to data-plane content such as blob data or secrets, and not to implicitly created resources (for example, VMs automatically created by an AKS cluster).
Integration into Existing IaC Workflows
Azure Deployment Stacks is created, updated, and deleted via Azure CLI and Azure PowerShell. The Azure portal currently supports viewing and deleting existing stacks, but not creating them; a full graphical management interface for all operations is still missing. Existing Bicep templates can be deployed in a stack without modification. For production, governance-sensitive Bicep-based IaC environments that go beyond simple resource group deployments, Deployment Stacks is a useful tool, provided management happens via CLI/PowerShell or CI/CD pipelines rather than the portal.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you in adopting Azure Deployment Stacks: designing the stack structure across subscriptions and management groups, designing DenySettings policies, and integrating into existing Bicep-based CI/CD pipelines.
Typical Use Cases
Frequently Asked Questions
What is the difference from a Resource Group?
A Resource Group is a logical container for resources without lifecycle semantics. A Deployment Stack is a resource of type Microsoft.Resources/deploymentStacks that treats all contained resources as a unit: shared update, shared deletion or detach, and optional DenySettings protection. A stack can be created at resource group, subscription, or management group scope.
What are DenySettings?
DenySettings allow restricting certain operations on stack resources. 'DenyDelete' prevents anyone from deleting a managed resource outside the stack. 'DenyWriteAndDelete' additionally blocks external configuration changes. Exceptions can be defined via excluded actions or up to five excluded Entra principals. The settings only apply to control-plane operations, not to data-plane operations such as blob or secret contents.
Is Azure Deployment Stacks Terraform-compatible?
Not directly. Azure Deployment Stacks is a native ARM/Bicep service. Terraform has its own state management. For Terraform users, Terraform state is the functional equivalent. Deployment Stacks primarily enhances ARM/Bicep-based IaC workflows.
Can I create Deployment Stacks through the Azure portal?
Currently, creating a deployment stack is only possible via Azure CLI or Azure PowerShell. The Azure portal supports viewing and deleting existing stacks, but stack creation and a full view of all managed resources are not yet implemented there.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
