services / Azure / ARM deployment

An Azure Resource Manager (ARM) deployment is a control-plane record of a template-based provisioning operation at management-group or tenant scope, capturing which resources were deployed and their configuration.

The deployment record itself is metadata/history; the dangerous capability is the write path, which executes an arbitrary template that can provision any resource type including role assignments, managed identities, and compute.

Microsoft.​Resources/​deployments/​delete

Deleting a deployment removes only the deployment history record, not the underlying provisioned resources, destroying operational deployment metadata and obscuring prior change activity.

Risks

1. Metadata destruction (MEDIUM)

Scope: LOW

This privilege allows access to data that are not meant to be public, but are otherwise not sensitive.

Links