Storage subresources need matching private connectivity, not a blob-only endpoint. In this case, a protected object is still present after a lifecycle deletion date. “A private endpoint and DNS for the file subresource as required” would not satisfy that requirement; the supported action is “An immutability policy, legal hold or incompatible lifecycle condition”. Retention safeguards can make automatic deletion ineligible.

Azure Files uses its file endpoint and share protocol/authentication settings. In this case, a protected object is still present after a lifecycle deletion date. “The file service endpoint with appropriate authentication and networking” would not satisfy that requirement; the supported action is “An immutability policy, legal hold or incompatible lifecycle condition”. Retention safeguards can make automatic deletion ineligible.

Blob listing can return pages rather than the entire container in one call. In this case, a protected object is still present after a lifecycle deletion date. “Continuation tokens for complete paged blob enumeration” would not satisfy that requirement; the supported action is “An immutability policy, legal hold or incompatible lifecycle condition”. Retention safeguards can make automatic deletion ineligible.

Retention safeguards can make automatic deletion ineligible. In this case, an administrator must upload files to a managed Azure Files share through PowerShell. “An immutability policy, legal hold or incompatible lifecycle condition” would not satisfy that requirement; the supported action is “The file service endpoint with appropriate authentication and networking”. Azure Files uses its file endpoint and share protocol/authentication settings.

Policies need precise scope and cannot override enforced retention or holds. In this case, an administrator must upload files to a managed Azure Files share through PowerShell. “Lifecycle filters, version predicates and immutability restrictions” would not satisfy that requirement; the supported action is “The file service endpoint with appropriate authentication and networking”. Azure Files uses its file endpoint and share protocol/authentication settings.

Azure Files provides managed network file shares accessible by multiple compatible clients. In this case, an administrator must upload files to a managed Azure Files share through PowerShell. “An Azure Files SMB share mounted by both VMs” would not satisfy that requirement; the supported action is “The file service endpoint with appropriate authentication and networking”. Azure Files uses its file endpoint and share protocol/authentication settings.

Policies need precise scope and cannot override enforced retention or holds. In this case, an operator configures only a blob private endpoint and SMB clients still fail. “Lifecycle filters, version predicates and immutability restrictions” would not satisfy that requirement; the supported action is “A private endpoint and DNS for the file subresource as required”. Storage subresources need matching private connectivity, not a blob-only endpoint.

Retention safeguards can make automatic deletion ineligible. In this case, an operator configures only a blob private endpoint and SMB clients still fail. “An immutability policy, legal hold or incompatible lifecycle condition” would not satisfy that requirement; the supported action is “A private endpoint and DNS for the file subresource as required”. Storage subresources need matching private connectivity, not a blob-only endpoint.

Blob listing can return pages rather than the entire container in one call. In this case, an operator configures only a blob private endpoint and SMB clients still fail. “Continuation tokens for complete paged blob enumeration” would not satisfy that requirement; the supported action is “A private endpoint and DNS for the file subresource as required”. Storage subresources need matching private connectivity, not a blob-only endpoint.

Marking an input as secure does not make a committed secret safe. In this case, an admin wants to deploy identical storage accounts to three regions using one Bicep source. “Use a secure parameter source such as approved secret management” would not satisfy that requirement; the supported action is “Use a for-expression to generate resources from a region parameter list”. Bicep resource loops support repeated declarative instances with per-instance expressions.

Secure deployment parameters reduce accidental exposure in deployment histories. In this case, an admin wants to deploy identical storage accounts to three regions using one Bicep source. “Define the parameter as secureString or a Bicep secure parameter” would not satisfy that requirement; the supported action is “Use a for-expression to generate resources from a region parameter list”. Bicep resource loops support repeated declarative instances with per-instance expressions.

What-if previews predicted control-plane changes before deployment. In this case, an admin wants to deploy identical storage accounts to three regions using one Bicep source. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Use a for-expression to generate resources from a region parameter list”. Bicep resource loops support repeated declarative instances with per-instance expressions.

Secure deployment parameters reduce accidental exposure in deployment histories. In this case, a copy/pasted ARM template has ten nearly identical resource definitions. “Define the parameter as secureString or a Bicep secure parameter” would not satisfy that requirement; the supported action is “Replace repetition with a Bicep loop or ARM copy construct”. Declarative iteration reduces drift in duplicated resource definitions.

Marking an input as secure does not make a committed secret safe. In this case, a copy/pasted ARM template has ten nearly identical resource definitions. “Use a secure parameter source such as approved secret management” would not satisfy that requirement; the supported action is “Replace repetition with a Bicep loop or ARM copy construct”. Declarative iteration reduces drift in duplicated resource definitions.

What-if previews predicted control-plane changes before deployment. In this case, a copy/pasted ARM template has ten nearly identical resource definitions. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Replace repetition with a Bicep loop or ARM copy construct”. Declarative iteration reduces drift in duplicated resource definitions.

Bicep resource loops support repeated declarative instances with per-instance expressions. In this case, an ARM deployment must use a secure database password without logging it in ordinary outputs. “Use a for-expression to generate resources from a region parameter list” would not satisfy that requirement; the supported action is “Define the parameter as secureString or a Bicep secure parameter”. Secure deployment parameters reduce accidental exposure in deployment histories.

What-if previews predicted control-plane changes before deployment. In this case, an ARM deployment must use a secure database password without logging it in ordinary outputs. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Define the parameter as secureString or a Bicep secure parameter”. Secure deployment parameters reduce accidental exposure in deployment histories.

Declarative iteration reduces drift in duplicated resource definitions. In this case, an ARM deployment must use a secure database password without logging it in ordinary outputs. “Replace repetition with a Bicep loop or ARM copy construct” would not satisfy that requirement; the supported action is “Define the parameter as secureString or a Bicep secure parameter”. Secure deployment parameters reduce accidental exposure in deployment histories.

Bicep resource loops support repeated declarative instances with per-instance expressions. In this case, an engineer puts a secret in a plain-text Bicep parameter file in version control. “Use a for-expression to generate resources from a region parameter list” would not satisfy that requirement; the supported action is “Use a secure parameter source such as approved secret management”. Marking an input as secure does not make a committed secret safe.

What-if previews predicted control-plane changes before deployment. In this case, an engineer puts a secret in a plain-text Bicep parameter file in version control. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Use a secure parameter source such as approved secret management”. Marking an input as secure does not make a committed secret safe.

Declarative iteration reduces drift in duplicated resource definitions. In this case, an engineer puts a secret in a plain-text Bicep parameter file in version control. “Replace repetition with a Bicep loop or ARM copy construct” would not satisfy that requirement; the supported action is “Use a secure parameter source such as approved secret management”. Marking an input as secure does not make a committed secret safe.

Secure deployment parameters reduce accidental exposure in deployment histories. In this case, a team wants to verify what resources an ARM template would change before deployment. “Define the parameter as secureString or a Bicep secure parameter” would not satisfy that requirement; the supported action is “Use deployment what-if at the correct scope”. What-if previews predicted control-plane changes before deployment.

Versioned reusable modules reduce maintenance divergence between deployments. In this case, a team wants to verify what resources an ARM template would change before deployment. “Reference a centrally managed versioned Bicep module” would not satisfy that requirement; the supported action is “Use deployment what-if at the correct scope”. What-if previews predicted control-plane changes before deployment.

ARM dependency analysis ensures dependent resources are deployed in a safe order. In this case, a team wants to verify what resources an ARM template would change before deployment. “Use correct resource references and dependencies in the deployment” would not satisfy that requirement; the supported action is “Use deployment what-if at the correct scope”. What-if previews predicted control-plane changes before deployment.

Modules encapsulate resource definitions with explicit parameters and outputs. In this case, a what-if report shows a network deletion that was unintended. “Extract a reusable Bicep module for the VNet” would not satisfy that requirement; the supported action is “Review and correct the deployment scope or template before applying changes”. Dry-run differences should be resolved before executing a destructive change.

Secure deployment parameters reduce accidental exposure in deployment histories. In this case, a what-if report shows a network deletion that was unintended. “Define the parameter as secureString or a Bicep secure parameter” would not satisfy that requirement; the supported action is “Review and correct the deployment scope or template before applying changes”. Dry-run differences should be resolved before executing a destructive change.

Versioned reusable modules reduce maintenance divergence between deployments. In this case, a what-if report shows a network deletion that was unintended. “Reference a centrally managed versioned Bicep module” would not satisfy that requirement; the supported action is “Review and correct the deployment scope or template before applying changes”. Dry-run differences should be resolved before executing a destructive change.

ARM dependency analysis ensures dependent resources are deployed in a safe order. In this case, a common VNet deployment should be reused by five application templates. “Use correct resource references and dependencies in the deployment” would not satisfy that requirement; the supported action is “Extract a reusable Bicep module for the VNet”. Modules encapsulate resource definitions with explicit parameters and outputs.

What-if previews predicted control-plane changes before deployment. In this case, a common VNet deployment should be reused by five application templates. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Extract a reusable Bicep module for the VNet”. Modules encapsulate resource definitions with explicit parameters and outputs.

Dry-run differences should be resolved before executing a destructive change. In this case, a common VNet deployment should be reused by five application templates. “Review and correct the deployment scope or template before applying changes” would not satisfy that requirement; the supported action is “Extract a reusable Bicep module for the VNet”. Modules encapsulate resource definitions with explicit parameters and outputs.

What-if previews predicted control-plane changes before deployment. In this case, a module is copied into five projects and no longer receives a security fix. “Use deployment what-if at the correct scope” would not satisfy that requirement; the supported action is “Reference a centrally managed versioned Bicep module”. Versioned reusable modules reduce maintenance divergence between deployments.

Declarative deployment ordering must include resources referenced by dependent objects. In this case, a module is copied into five projects and no longer receives a security fix. “Declare or infer dependency on the subnet resource” would not satisfy that requirement; the supported action is “Reference a centrally managed versioned Bicep module”. Versioned reusable modules reduce maintenance divergence between deployments.

ARM dependency analysis ensures dependent resources are deployed in a safe order. In this case, a module is copied into five projects and no longer receives a security fix. “Use correct resource references and dependencies in the deployment” would not satisfy that requirement; the supported action is “Reference a centrally managed versioned Bicep module”. Versioned reusable modules reduce maintenance divergence between deployments.