Classic Azure deployments often leave behind orphaned role assignments, creating clutter and confusion. In this post, I explore how Deployment Stacks—tested via GitHub Actions—offer a cleaner, more predictable way to manage and remove role assignments at the subscription level. Includes code, setup insights, and lessons learned.

This guide walks you through setting up IaC with Azure DevOps using Bicep and Deployment Stacks. Even a minimal setup can make a big difference.

Github has changed a lot. While working mostly in Azure DevOps I haven’t followed all the development on Github. Now when I look at that, I am really amazed.

Private Repos for Free accounts

Well, for me it is not as interesting, because with my free account, I don’t see any harm having my labs public. But I know, some people used bitbucket for their smaller private repos.

Github Project

I suppose it is the Azure DevOps Project concept that was copied to Github, a place for planning and having multiple connected repos.

Using Azure Key Vault in a Pipeline is cool, but it is less secure.

The Key Vault setup

Have you tried the Key Vault Step in an Azure DevOps Pipeline? If you haven’t, please follow these awesome guides:

• Azure DevOps Labs. Using secrets from Azure Key Vault in a pipeline
• Tobias Zimmergren. Using Azure Key Vault Secrets in Azure DevOps pipelines

The steps described in these guides are easy, but that effort made me think about the first pair of pros and cons.

I created a sample ASP.NET Core app with React. 

dotnet new react

Then it took a couple of hours to get the build to work. Here is my working azure-pipelines.yml:

Resources:

• Azure Pipelines Predefined Variables
• Create ASP.NET Core app with React
• PublishWebProjects must be false