Deployment Stacks - Validate Stack At Subscription

Service:: Resource Management

API Version:: 2025-07-01

Runs preflight validation on the Deployment stack template at the specified scope to verify its acceptance to Azure Resource Manager.

POST https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Resources/deploymentStacks/{deploymentStackName}/validate?api-version=2025-07-01

URI Parameters

Name	In	Required	Type	Description
deploymentStackName	path	True	string minLength: 1 maxLength: 90 pattern: ^[-\w\._]+$	Name of the deployment stack.
subscriptionId	path	True	string (uuid)	The ID of the target subscription. The value must be an UUID.
api-version	query	True	string minLength: 1	The API version to use for this operation.

Request Body

Name	Required	Type	Description
properties.actionOnUnmanage	True	ActionOnUnmanage	Defines the behavior of resources that are no longer managed after the Deployment stack is updated or deleted.
properties.denySettings	True	DenySettings	Defines how resources deployed by the stack are locked.
location		string	The geo-location where the resource lives. Required for subscription and management group scoped stacks. The location is inherited from the resource group for resource group scoped stacks.
properties.bypassStackOutOfSyncError		boolean	Flag to bypass service errors that indicate the stack resource list is not correctly synchronized.
properties.debugSetting		DeploymentStacksDebugSetting	The debug setting of the deployment.
properties.deploymentScope		string	The scope at which the initial deployment should be created. If a scope is not specified, it will default to the scope of the deployment stack. Valid scopes are: management group (format: '/providers/Microsoft.Management/managementGroups/{managementGroupId}'), subscription (format: '/subscriptions/{subscriptionId}'), resource group (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}').
properties.description		string maxLength: 4096	Deployment stack description. Max length of 4096 characters.
properties.extensionConfigs		object	The deployment extension configs. Keys of this object are extension aliases as defined in the deployment template.
properties.externalInputDefinitions		<string, DeploymentExternalInputDefinition>	External input definitions, used by external tooling to define expected external input values.
properties.externalInputs		<string, DeploymentExternalInput>	External input values, used by external tooling for parameter evaluation.
properties.parameters		<string, DeploymentParameter>	Name and value pairs that define the deployment parameters for the template. Use this element when providing the parameter values directly in the request, rather than linking to an existing parameter file. Use either the parametersLink property or the parameters property, but not both.
properties.parametersLink		DeploymentStacksParametersLink	The URI of parameters file. Use this element to link to an existing parameters file. Use either the parametersLink property or the parameters property, but not both.
properties.template		management.azure.com.resources.deploymentstacks.validatestackatsubscription	The template content. You use this element when you want to pass the template syntax directly in the request rather than link to an existing template. It can be a JObject or well-formed JSON string. Use either the templateLink property or the template property, but not both.
properties.templateLink		DeploymentStacksTemplateLink	The URI of the template. Use either the templateLink property or the template property, but not both.
properties.validationLevel		ValidationLevel	The validation level of the deployment stack
tags		object	Resource tags.

Responses

Name	Type	Description
200 OK	DeploymentStackValidateResult	Azure operation completed successfully.
202 Accepted		Resource operation accepted. Headers Location: string Retry-After: integer
400 Bad Request	DeploymentStackValidateResult	Resource validation failed.
Other Status Codes	ErrorResponse	An unexpected error response.

Security

azure_auth

Azure Active Directory OAuth2 Flow.

Type: oauth2
Flow: implicit
Authorization URL: https://login.microsoftonline.com/common/oauth2/authorize

Scopes

Name	Description
user_impersonation	impersonate your user account

Examples

Validate a subscription Deployment stack

Sample request

POST https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Resources/deploymentStacks/simpleDeploymentStack/validate?api-version=2025-07-01

{
  "location": "eastus",
  "tags": {
    "tagkey": "tagVal"
  },
  "properties": {
    "actionOnUnmanage": {
      "resources": "delete",
      "resourceGroups": "delete",
      "managementGroups": "delete"
    },
    "denySettings": {
      "mode": "denyDelete",
      "excludedPrincipals": [
        "principal"
      ],
      "excludedActions": [
        "action"
      ],
      "applyToChildScopes": false
    },
    "templateLink": {
      "uri": "https://example.com/exampleTemplate.json"
    },
    "parameters": {
      "parameter1": {
        "value": "a string"
      }
    }
  }
}

from azure.identity import DefaultAzureCredential

from azure.mgmt.resource.deploymentstacks import DeploymentStacksClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-resource-deploymentstacks
# USAGE
    python deployment_stack_subscription_validate.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = DeploymentStacksClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.deployment_stacks.begin_validate_stack_at_subscription(
        deployment_stack_name="simpleDeploymentStack",
        deployment_stack={
            "location": "eastus",
            "properties": {
                "actionOnUnmanage": {"managementGroups": "delete", "resourceGroups": "delete", "resources": "delete"},
                "denySettings": {
                    "applyToChildScopes": False,
                    "excludedActions": ["action"],
                    "excludedPrincipals": ["principal"],
                    "mode": "denyDelete",
                },
                "parameters": {"parameter1": {"value": "a string"}},
                "templateLink": {"uri": "https://example.com/exampleTemplate.json"},
            },
            "tags": {"tagkey": "tagVal"},
        },
    ).result()
    print(response)


# x-ms-original-file: 2025-07-01/DeploymentStackSubscriptionValidate.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

package armdeploymentstacks_test

import (
	"context"
	"log"

	"github.com/Azure/azure-sdk-for-go/sdk/azcore/to"
	"github.com/Azure/azure-sdk-for-go/sdk/azidentity"
	"github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armdeploymentstacks/v2"
)

// Generated from example definition: 2025-07-01/DeploymentStackSubscriptionValidate.json
func ExampleClient_BeginValidateStackAtSubscription() {
	cred, err := azidentity.NewDefaultAzureCredential(nil)
	if err != nil {
		log.Fatalf("failed to obtain a credential: %v", err)
	}
	ctx := context.Background()
	clientFactory, err := armdeploymentstacks.NewClientFactory("00000000-0000-0000-0000-000000000000", cred, nil)
	if err != nil {
		log.Fatalf("failed to create client: %v", err)
	}
	poller, err := clientFactory.NewClient().BeginValidateStackAtSubscription(ctx, "simpleDeploymentStack", armdeploymentstacks.DeploymentStack{
		Location: to.Ptr("eastus"),
		Tags: map[string]*string{
			"tagkey": to.Ptr("tagVal"),
		},
		Properties: &armdeploymentstacks.DeploymentStackProperties{
			ActionOnUnmanage: &armdeploymentstacks.ActionOnUnmanage{
				Resources:        to.Ptr(armdeploymentstacks.UnmanageActionResourceModeDelete),
				ResourceGroups:   to.Ptr(armdeploymentstacks.UnmanageActionResourceGroupModeDelete),
				ManagementGroups: to.Ptr(armdeploymentstacks.UnmanageActionManagementGroupModeDelete),
			},
			DenySettings: &armdeploymentstacks.DenySettings{
				Mode: to.Ptr(armdeploymentstacks.DenySettingsModeDenyDelete),
				ExcludedPrincipals: []*string{
					to.Ptr("principal"),
				},
				ExcludedActions: []*string{
					to.Ptr("action"),
				},
				ApplyToChildScopes: to.Ptr(false),
			},
			TemplateLink: &armdeploymentstacks.TemplateLink{
				URI: to.Ptr("https://example.com/exampleTemplate.json"),
			},
			Parameters: map[string]*armdeploymentstacks.DeploymentParameter{
				"parameter1": {
					Value: "a string",
				},
			},
		},
	}, nil)
	if err != nil {
		log.Fatalf("failed to finish the request: %v", err)
	}
	res, err := poller.PollUntilDone(ctx, nil)
	if err != nil {
		log.Fatalf("failed to pull the result: %v", err)
	}
	// You could use response here. We use blank identifier for just demo purposes.
	_ = res
	// If the HTTP response code is 200 as defined in example definition, your response structure would look as follows. Please pay attention that all the values in the output are fake values for just demo purposes.
	// res = armdeploymentstacks.ClientValidateStackAtSubscriptionResponse{
	// 	DeploymentStackValidateResult: &armdeploymentstacks.DeploymentStackValidateResult{
	// 		ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Resources/deploymentStacks/simpleDeploymentStack"),
	// 		Name: to.Ptr("simpleDeploymentStack"),
	// 		Type: to.Ptr("Microsoft.Resources/deploymentStacks"),
	// 		Properties: &armdeploymentstacks.DeploymentStackValidateProperties{
	// 			CorrelationID: to.Ptr("00000000-0000-0000-0000-000000000000"),
	// 			DenySettings: &armdeploymentstacks.DenySettings{
	// 				Mode: to.Ptr(armdeploymentstacks.DenySettingsModeDenyDelete),
	// 				ExcludedPrincipals: []*string{
	// 					to.Ptr("principal"),
	// 				},
	// 				ExcludedActions: []*string{
	// 					to.Ptr("action"),
	// 				},
	// 				ApplyToChildScopes: to.Ptr(false),
	// 			},
	// 			DeploymentScope: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000"),
	// 			Description: to.Ptr("A validation description."),
	// 			Parameters: map[string]*armdeploymentstacks.DeploymentParameter{
	// 				"parameter1": &armdeploymentstacks.DeploymentParameter{
	// 					Type: to.Ptr("string"),
	// 					Value: "a string",
	// 				},
	// 			},
	// 			ValidatedResources: []*armdeploymentstacks.ResourceReference{
	// 				{
	// 					ID: to.Ptr("/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignment/roleassignment1"),
	// 				},
	// 			},
	// 		},
	// 	},
	// }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { DeploymentStacksClient } = require("@azure/arm-resourcesdeploymentstacks");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to runs preflight validation on the Deployment stack template at the specified scope to verify its acceptance to Azure Resource Manager.
 *
 * @summary runs preflight validation on the Deployment stack template at the specified scope to verify its acceptance to Azure Resource Manager.
 * x-ms-original-file: 2025-07-01/DeploymentStackSubscriptionValidate.json
 */
async function validateASubscriptionDeploymentStack() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-0000-0000-0000-000000000000";
  const client = new DeploymentStacksClient(credential, subscriptionId);
  const result = await client.deploymentStacks.validateStackAtSubscription(
    "simpleDeploymentStack",
    {
      location: "eastus",
      tags: { tagkey: "tagVal" },
      properties: {
        actionOnUnmanage: {
          resources: "delete",
          resourceGroups: "delete",
          managementGroups: "delete",
        },
        denySettings: {
          mode: "denyDelete",
          excludedPrincipals: ["principal"],
          excludedActions: ["action"],
          applyToChildScopes: false,
        },
        templateLink: { uri: "https://example.com/exampleTemplate.json" },
        parameters: { parameter1: { value: "a string" } },
      },
    },
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Resources/deploymentStacks/simpleDeploymentStack",
  "name": "simpleDeploymentStack",
  "type": "Microsoft.Resources/deploymentStacks",
  "properties": {
    "correlationId": "00000000-0000-0000-0000-000000000000",
    "denySettings": {
      "mode": "denyDelete",
      "excludedPrincipals": [
        "principal"
      ],
      "excludedActions": [
        "action"
      ],
      "applyToChildScopes": false
    },
    "deploymentScope": "/subscriptions/00000000-0000-0000-0000-000000000000",
    "description": "A validation description.",
    "parameters": {
      "parameter1": {
        "type": "string",
        "value": "a string"
      }
    },
    "validatedResources": [
      {
        "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/roleAssignment/roleassignment1"
      }
    ]
  }
}

Status code:: 202

Location: https://example.com
Retry-After: 15

Status code:: 400

{
  "error": {
    "code": "ErrorCode",
    "message": "Deployment validation failed"
  }
}

Definitions

Name	Description
ActionOnUnmanage	Defines the behavior of resources that are no longer managed after the stack is updated or deleted.
createdByType	The type of identity that created the resource.
DenySettings	Defines how resources deployed by the Deployment stack are locked.
DenySettingsMode	denySettings Mode that defines denied actions.
DenyStatusMode	denyAssignment settings applied to the resource.
DeploymentExtension	Details about the usage of a deployment extension.
DeploymentExtensionConfigItem	The value or how to get a value for an extension config property.
DeploymentExternalInput	Deployment external input for parameterization.
DeploymentExternalInputDefinition	Deployment external input definition for parameterization.
DeploymentParameter	Deployment parameter for the template.
DeploymentStack	Deployment stack object.
DeploymentStackProvisioningState	State of the deployment stack.
DeploymentStacksDebugSetting	The debug setting.
DeploymentStacksParametersLink	Entity representing the reference to the deployment parameters.
DeploymentStacksTemplateLink	Entity representing the reference to the template.
DeploymentStackValidateProperties	The Deployment stack validation result details.
DeploymentStackValidateResult	The Deployment stack validation result.
ErrorAdditionalInfo	The resource management error additional info.
ErrorDetail	The error detail.
ErrorResponse	Error response
KeyVaultParameterReference	Azure Key Vault parameter reference.
KeyVaultReference	Azure Key Vault reference.
ManagedResourceReference	The managed resource model.
ResourceReference	The resourceId model.
ResourceReferenceExtended	The resourceId extended model. This is used to document failed resources with a resourceId and a corresponding error.
ResourceStatusMode	Current management state of the resource in the deployment stack.
ResourcesWithoutDeleteSupportAction	Specifies an action for resources that do not support deletion.
systemData	Metadata pertaining to creation and last modification of the resource.
UnmanageActionManagementGroupMode	Specifies an action for a newly unmanaged resource.
UnmanageActionResourceGroupMode	Specifies an action for a newly unmanaged resource group.
UnmanageActionResourceMode	Specifies an action for a newly unmanaged resource.
ValidationLevel	The level of validation performed on the deployment.

ActionOnUnmanage

Object

Defines the behavior of resources that are no longer managed after the stack is updated or deleted.

Name	Type	Description
managementGroups	UnmanageActionManagementGroupMode	Specifies an action for a newly unmanaged resource management group.
resourceGroups	UnmanageActionResourceGroupMode	Specifies an action for a newly unmanaged resource group.
resources	UnmanageActionResourceMode	Specifies an action for a newly unmanaged resource.
resourcesWithoutDeleteSupport	ResourcesWithoutDeleteSupportAction	Some resources do not support deletion. This flag will denote how the stack should handle those resources.

createdByType

Enumeration

The type of identity that created the resource.

Value	Description
User
Application
ManagedIdentity
Key

DenySettings

Object

Defines how resources deployed by the Deployment stack are locked.

Name	Type	Description
applyToChildScopes	boolean	DenySettings will be applied to child resource scopes of every managed resource with a deny assignment.
excludedActions	string[]	List of role-based management operations that are excluded from the denySettings. Up to 200 actions are permitted. If the denySetting mode is set to 'denyWriteAndDelete', then the following actions are automatically appended to 'excludedActions': '*/read' and 'Microsoft.Authorization/locks/delete'. If the denySetting mode is set to 'denyDelete', then the following actions are automatically appended to 'excludedActions': 'Microsoft.Authorization/locks/delete'. Duplicate actions will be removed.
excludedPrincipals	string[]	List of AAD principal IDs excluded from the lock. Up to 5 principals are permitted.
mode	DenySettingsMode	denySettings Mode that defines denied actions.

DenySettingsMode

Enumeration

denySettings Mode that defines denied actions.

Value	Description
denyDelete	Authorized users are able to read and modify the resources, but cannot delete.
denyWriteAndDelete	Authorized users can read from a resource, but cannot modify or delete it.
none	No denyAssignments have been applied.

DenyStatusMode

Enumeration

denyAssignment settings applied to the resource.

Value	Description
denyDelete	Authorized users are able to read and modify the resources, but cannot delete.
notSupported	Resource type does not support denyAssignments.
inapplicable	denyAssignments are not supported on resources outside the scope of the deployment stack.
denyWriteAndDelete	Authorized users can only read from a resource, but cannot modify or delete it.
removedBySystem	Deny assignment has been removed by Azure due to a resource management change (management group move, etc.)
none	No denyAssignments have been applied.
unknown	The denyAssignment status is unknown.

DeploymentExtension

Object

Details about the usage of a deployment extension.

Name	Type	Description
config	<string, DeploymentExtensionConfigItem>	The configuration used for deployment. The keys of this object should align with the extension config schema.
configId	string	The configuration ID of the extension usage. It uniquely identifies a target the extension deploys to.
name	string	The extension name.
version	string	The extension version.

DeploymentExtensionConfigItem

Object

The value or how to get a value for an extension config property.

Name	Type	Description
keyVaultReference	KeyVaultParameterReference	The key vault reference of the config item.
type	string	The type of the value.
value	management.azure.com.resources.deploymentstacks.validatestackatsubscription	The value of the config item. The type is determined by the extension config schema.

DeploymentExternalInput

Object

Deployment external input for parameterization.

Name	Type	Description
value	management.azure.com.resources.deploymentstacks.validatestackatsubscription	External input value.

DeploymentExternalInputDefinition

Object

Deployment external input definition for parameterization.

Name	Type	Description
config	management.azure.com.resources.deploymentstacks.validatestackatsubscription	Configuration for the external input.
kind	string	The kind of external input.

DeploymentParameter

Object

Deployment parameter for the template.

Name	Type	Description
expression	string	Input expression to the parameter.
reference	KeyVaultParameterReference	Azure Key Vault parameter reference.
type	string	Type of the value.
value	management.azure.com.resources.deploymentstacks.validatestackatsubscription	Input value to the parameter.

DeploymentStack

Object

Deployment stack object.

Name	Type	Description
id	string (arm-id)	Fully qualified resource ID for the resource. E.g. "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}"
location	string	The geo-location where the resource lives. Required for subscription and management group scoped stacks. The location is inherited from the resource group for resource group scoped stacks.
name	string	The name of the resource
properties.actionOnUnmanage	ActionOnUnmanage	Defines the behavior of resources that are no longer managed after the Deployment stack is updated or deleted.
properties.bypassStackOutOfSyncError	boolean	Flag to bypass service errors that indicate the stack resource list is not correctly synchronized.
properties.correlationId	string	The correlation id of the last Deployment stack upsert or delete operation. It is in GUID format and is used for tracing.
properties.debugSetting	DeploymentStacksDebugSetting	The debug setting of the deployment.
properties.deletedResources	ResourceReference[]	An array of resources that were deleted during the most recent Deployment stack update. Deleted means that the resource was removed from the template and relevant deletion operations were specified.
properties.denySettings	DenySettings	Defines how resources deployed by the stack are locked.
properties.deploymentExtensions	DeploymentExtension[]	The extensions used during deployment. Contains extension data for all extensible resources managed by the stack.
properties.deploymentId	string	The resourceId of the deployment resource created by the deployment stack.
properties.deploymentScope	string	The scope at which the initial deployment should be created. If a scope is not specified, it will default to the scope of the deployment stack. Valid scopes are: management group (format: '/providers/Microsoft.Management/managementGroups/{managementGroupId}'), subscription (format: '/subscriptions/{subscriptionId}'), resource group (format: '/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}').
properties.description	string maxLength: 4096	Deployment stack description. Max length of 4096 characters.
properties.detachedResources	ResourceReference[]	An array of resources that were detached during the most recent Deployment stack update. Detached means that the resource was removed from the template, but no relevant deletion operations were specified. So, the resource still exists while no longer being associated with the stack.
properties.duration	string	The duration of the last successful Deployment stack update.
properties.error	ErrorDetail	The error detail.
properties.extensionConfigs	object	The deployment extension configs. Keys of this object are extension aliases as defined in the deployment template.
properties.externalInputDefinitions	<string, DeploymentExternalInputDefinition>	External input definitions, used by external tooling to define expected external input values.
properties.externalInputs	<string, DeploymentExternalInput>	External input values, used by external tooling for parameter evaluation.
properties.failedResources	ResourceReferenceExtended[]	An array of resources that failed to reach goal state during the most recent update. Each resourceId is accompanied by an error message.
properties.outputs	management.azure.com.resources.deploymentstacks.validatestackatsubscription	The outputs of the deployment resource created by the deployment stack.
properties.parameters	<string, DeploymentParameter>	Name and value pairs that define the deployment parameters for the template. Use this element when providing the parameter values directly in the request, rather than linking to an existing parameter file. Use either the parametersLink property or the parameters property, but not both.
properties.parametersLink	DeploymentStacksParametersLink	The URI of parameters file. Use this element to link to an existing parameters file. Use either the parametersLink property or the parameters property, but not both.
properties.provisioningState	DeploymentStackProvisioningState	State of the deployment stack.
properties.resources	ManagedResourceReference[]	An array of resources currently managed by the deployment stack.
properties.template	management.azure.com.resources.deploymentstacks.validatestackatsubscription	The template content. You use this element when you want to pass the template syntax directly in the request rather than link to an existing template. It can be a JObject or well-formed JSON string. Use either the templateLink property or the template property, but not both.
properties.templateLink	DeploymentStacksTemplateLink	The URI of the template. Use either the templateLink property or the template property, but not both.
properties.validationLevel	ValidationLevel	The validation level of the deployment stack
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
tags	object	Resource tags.
type	string	The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts"

DeploymentStackProvisioningState

Enumeration

State of the deployment stack.

Value	Description
creating	The deployment stack is currently being created
validating	The deployment stack is currently being validated
waiting	The deployment stack is currently waiting
deploying	The deployment stack is currently deploying
canceling	The deployment stack is being cancelled
updatingDenyAssignments	The deployment stack is updating deny assignments
deletingResources	The deployment stack is deleting resources
succeeded	The deployment stack completed successfully
failed	The deployment stack has failed
canceled	The deployment stack has been cancelled
deleting	The deployment stack is being deleted
initializing	The deployment stack is currently being initialized
running	The deployment stack is currently performing an operation

DeploymentStacksDebugSetting

Object

The debug setting.

Name	Type	Description
detailLevel	string	Specifies the type of information to log for debugging. The permitted values are none, requestContent, responseContent, or both requestContent and responseContent separated by a comma. The default is none. When setting this value, carefully consider the type of information that is being passed in during deployment. By logging information about the request or response, sensitive data that is retrieved through the deployment operations could potentially be exposed.

DeploymentStacksParametersLink

Object

Entity representing the reference to the deployment parameters.

Name	Type	Description
contentVersion	string	If included, must match the ContentVersion in the template.
uri	string	The URI of the parameters file.

DeploymentStacksTemplateLink

Object

Entity representing the reference to the template.

Name	Type	Description
contentVersion	string	If included, must match the ContentVersion in the template.
id	string	The resourceId of a Template Spec. Use either the id or uri property, but not both.
queryString	string	The query string (for example, a SAS token) to be used with the templateLink URI.
relativePath	string	The relativePath property can be used to deploy a linked template at a location relative to the parent. If the parent template was linked with a TemplateSpec, this will reference an artifact in the TemplateSpec. If the parent was linked with a URI, the child deployment will be a combination of the parent and relativePath URIs.
uri	string	The URI of the template to deploy. Use either the uri or id property, but not both.

DeploymentStackValidateProperties

Object

The Deployment stack validation result details.

Name	Type	Description
actionOnUnmanage	ActionOnUnmanage	Defines the behavior of resources that are no longer managed after the Deployment stack is updated or deleted.
correlationId	string	The correlation id of the Deployment stack validate operation. It is in GUID format and is used for tracing.
denySettings	DenySettings	The Deployment stack deny settings.
deploymentExtensions	DeploymentExtension[]	The deployment extensions.
deploymentScope	string	The Deployment stack deployment scope.
description	string	The Deployment stack validation description.
parameters	<string, DeploymentParameter>	Deployment parameters.
templateLink	DeploymentStacksTemplateLink	The URI of the template.
validatedResources	ResourceReference[]	The array of resources that were validated.
validationLevel	ValidationLevel	The validation level of the deployment stack

DeploymentStackValidateResult

Object

The Deployment stack validation result.

Name	Type	Description
error	ErrorDetail	The error detail.
id	string	String Id used to locate any resource on Azure.
name	string	Name of this resource.
properties	DeploymentStackValidateProperties	The validation result details.
systemData	systemData	Azure Resource Manager metadata containing createdBy and modifiedBy information.
type	string	Type of this resource.

ErrorAdditionalInfo

Object

The resource management error additional info.

Name	Type	Description
info	object	The additional info.
type	string	The additional info type.

ErrorDetail

Object

The error detail.

Name	Type	Description
additionalInfo	ErrorAdditionalInfo[]	The error additional info.
code	string	The error code.
details	ErrorDetail[]	The error details.
message	string	The error message.
target	string	The error target.

ErrorResponse

Object

Error response

Name	Type	Description
error	ErrorDetail	The error object.

KeyVaultParameterReference

Object

Azure Key Vault parameter reference.

Name	Type	Description
keyVault	KeyVaultReference	Azure Key Vault reference.
secretName	string	Azure Key Vault secret name.
secretVersion	string	Azure Key Vault secret version.

KeyVaultReference

Object

Azure Key Vault reference.

Name	Type	Description
id	string	Azure Key Vault resourceId.

ManagedResourceReference

Object

The managed resource model.

Name	Type	Default value	Description
apiVersion	string		The API version the resource was deployed with
denyStatus	DenyStatusMode	none	denyAssignment settings applied to the resource.
extension	DeploymentExtension		The extension the resource was deployed with.
id	string		The ARM Resource ID of a resource managed by the deployment stack.
identifiers	management.azure.com.resources.deploymentstacks.validatestackatsubscription		The extensible resource identifiers.
status	ResourceStatusMode		Current management state of the resource in the deployment stack.
type	string		The resource type.

ResourceReference

Object

The resourceId model.

Name	Type	Description
apiVersion	string	The API version the resource was deployed with
extension	DeploymentExtension	The extension the resource was deployed with.
id	string	The ARM Resource ID of a resource managed by the deployment stack.
identifiers	management.azure.com.resources.deploymentstacks.validatestackatsubscription	The extensible resource identifiers.
type	string	The resource type.

ResourceReferenceExtended

Object

The resourceId extended model. This is used to document failed resources with a resourceId and a corresponding error.

Name	Type	Description
apiVersion	string	The API version the resource was deployed with
error	ErrorDetail	The error detail.
extension	DeploymentExtension	The extension the resource was deployed with.
id	string	The ARM Resource ID of a resource managed by the deployment stack.
identifiers	management.azure.com.resources.deploymentstacks.validatestackatsubscription	The extensible resource identifiers.
type	string	The resource type.

ResourceStatusMode

Enumeration

Current management state of the resource in the deployment stack.

Value	Description
managed	This resource is managed by the deployment stack.
removeDenyFailed	Unable to remove the deny assignment on resource.
deleteFailed	Unable to delete the resource from Azure. The delete will be retried on the next stack deployment, or can be deleted manually.

ResourcesWithoutDeleteSupportAction

Enumeration

Specifies an action for resources that do not support deletion.

Value	Description
detach	Detach the specified resources from the deployment stack and continue.
fail	Fail the deployment stack if resources cannot be deleted.

systemData

Object

Metadata pertaining to creation and last modification of the resource.

Name	Type	Description
createdAt	string (date-time)	The timestamp of resource creation (UTC).
createdBy	string	The identity that created the resource.
createdByType	createdByType	The type of identity that created the resource.
lastModifiedAt	string (date-time)	The timestamp of resource last modification (UTC)
lastModifiedBy	string	The identity that last modified the resource.
lastModifiedByType	createdByType	The type of identity that last modified the resource.

UnmanageActionManagementGroupMode

Enumeration

Specifies an action for a newly unmanaged resource.

Value	Description
delete	Delete the management groups from Azure.
detach	Keep the management groups in Azure.

UnmanageActionResourceGroupMode

Enumeration

Specifies an action for a newly unmanaged resource group.

Value	Description
delete	Delete the resource groups from Azure.
detach	Keep the resource groups in Azure.

UnmanageActionResourceMode

Enumeration

Specifies an action for a newly unmanaged resource.

Value	Description
delete	Delete the resources from Azure
detach	Keep the resources in Azure

ValidationLevel

Enumeration

The level of validation performed on the deployment.

Value	Description
Template	Static analysis of the template is performed.
Provider	Static analysis of the template is performed and resource declarations are sent to resource providers for semantic validation. Validates that the caller has RBAC write permissions on each resource.
ProviderNoRbac	Static analysis of the template is performed and resource declarations are sent to resource providers for semantic validation. Skips validating that the caller has RBAC write permissions on each resource.