Design infrastructure solutions · Topic 5 of 10
Automated Deployment of Applications
AZ-305 deployment design: infrastructure as code with Bicep and template specs, deployment stacks, CI/CD pipelines, deployment slots and safe release strategies.
- 4 min
- Bicep is the preferred Azure IaC. Template specs store versioned templates. Deployment stacks manage resource groups of resources with deny settings.
- Use OIDC or workload identity federation for pipelines instead of stored secrets.
- Slots give zero downtime swaps and quick rollback. Flex Consumption has no slots.
What it is
Automated deployment means environments and applications are created by code and pipelines, not by hand. It gives repeatability, speed, auditability and safer releases. Two layers matter: infrastructure as code (IaC) that defines Azure resources, and CI/CD pipelines that build, test and release applications with strategies such as blue green and canary.
How it works
Infrastructure as code
| Tool | Notes |
|---|---|
| Bicep | Microsoft's declarative language for Azure. Compiles to ARM JSON, concise, modular, first class Azure support, no state file to manage |
| ARM templates | The underlying JSON format. Still valid, but Bicep is preferred for authoring |
| Terraform | Multi cloud IaC with a state file. Good where an organisation already uses it |
| Azure CLI and PowerShell | Imperative scripting |
| Template specs | Versioned templates stored in Azure and shared with RBAC, so teams deploy approved standards |
| Deployment stacks | Manage a group of resources as one unit. Support deny settings to block deletion or changes and cleanup of resources removed from the template. The replacement for Azure Blueprints |
| Azure Verified Modules | Microsoft maintained, tested Bicep and Terraform modules |
IaC is idempotent: deploying the same template again gives the same result. Use parameters and parameter files for environment differences, what if to preview changes, and modules for reuse. Keep IaC in source control and deploy only through a pipeline.
CI/CD pipelines
| Service | Use |
|---|---|
| GitHub Actions | Workflows in GitHub, with OIDC federation to Azure, so no stored secret |
| Azure Pipelines (Azure DevOps) | YAML pipelines, environments with approvals and checks, service connections with workload identity federation |
| Azure Deployment Environments | Self service, governed environments for developers |
| Azure Developer CLI (azd) | Opinionated templates that provision and deploy an app |
Pipeline stages: build, test, security scan, deploy to dev, test, production with approvals between. Store secrets in Key Vault, and use managed identities or federation for the deployment identity, with least privilege at the target scope.
Deployment strategies
| Strategy | How it works |
|---|---|
| Rolling | Update instances gradually. Needs backward compatibility |
| Blue green | Two full environments. Switch traffic to the new one, keep the old for instant rollback. App Service deployment slots swap staging into production |
| Canary | Send a small share of traffic to the new version, then increase. Use Front Door, Application Gateway, Container Apps traffic splitting or feature flags |
| Feature flags | Release code dark and turn it on later, decoupling deployment from release |
| A/B testing | Compare versions with metrics |
Deployment slots (App Service, Functions Premium) give a pre warmed staging copy, slot specific settings, and a fast, reversible swap. Flex Consumption has no slots, so it relies on rolling updates. Container Apps revisions and AKS support rolling and blue green with ingress control.
Choosing quickly
| Requirement | Answer |
|---|---|
| Define Azure resources declaratively with the best Azure support | Bicep |
| Share approved templates across teams with RBAC | Template specs |
| Deploy a set of resources and block users from deleting them | Deployment stacks with deny settings |
| Deploy from GitHub with no stored credential | GitHub Actions with OIDC federation |
| Zero downtime release with instant rollback on App Service | Deployment slots and swap |
| Release to 5 percent of users first | Canary with traffic splitting or a feature flag |
A worked scenario
A team ships a web API on App Service. Infrastructure lives in Bicep modules published as template specs and deployed as a deployment stack with deny settings. A GitHub Actions pipeline authenticates with OIDC federation, runs tests and a what if, deploys to a staging slot, runs smoke tests, then swaps into production. New features ship behind App Configuration feature flags and roll out to 10 percent of users first.
What to remember for the exam
- Bicep is the preferred Azure IaC. Template specs store versioned templates. Deployment stacks manage resource groups of resources with deny settings.
- Use OIDC or workload identity federation for pipelines instead of stored secrets.
- Slots give zero downtime swaps and quick rollback. Flex Consumption has no slots.
- Canary releases use traffic splitting or feature flags.
- Always preview with what if and deploy through a pipeline.
"Prevent users deleting deployed resources" means deployment stacks with deny settings, since Blueprints is retiring.
How the exam asks about this
- "Deploy standard networking from approved, versioned templates." Template specs.
- "Replace Azure Blueprints for subscription setup." Deployment stacks with template specs.
- "A pipeline must deploy without secrets." Federated credentials with OIDC.
- "Swap a tested version into production with instant rollback." App Service deployment slots.
Common mistakes
Hand editing production. Use pipelines.
Storing service principal secrets in the pipeline. Use federation.
Skipping what if and tests.
Assuming slots exist on every plan.
Check yourself
Which language is preferred for Azure infrastructure as code?
Bicep.
What gives a safe swap of a staged app into production?
Deployment slots.
Which feature blocks deletion of resources a stack manages?
Deployment stack deny settings.
Topic 5 of 10 in Design infrastructure solutions
Test yourself on Design infrastructure solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.