Question

Your team maintains an Azure resource group that should contain ONLY the resources defined in a Bicep template. During a release stage, an ARM/Bicep deployment task provisions a storage account, a Key Vault, and an App Service plan. A previous manual deployment left an orphaned public IP address and an unused network security group in the same resource group. The release pipeline must remove any resources that are not declared in the template on every deployment, while keeping the pipeline declarative. Which deployment configuration should you use?

Accepted Answer

Run the deployment in Complete mode so that Azure Resource Manager deletes resources in the resource group that are not present in the template.

Answer

Run the deployment in Incremental mode and add a separate script task that enumerates and deletes all resources not referenced by the template.

Answer

Enable the 'what-if' operation on the deployment task so ARM automatically removes resources flagged as deletions.

Answer

Run the deployment in Incremental mode with the 'rollbackToLastSuccessful' option enabled to reset the resource group state.