Operations

Use the task-specific runbook for operational changes and recovery:

• For integrated Terraform, use foundation reconfiguration and recovery, application updates and removal. Retain the provider and backend and follow the single-writer execution policy.
• Reapply a reviewed deployment, redeploy applications, change runtime settings and rotate secrets in the Deploy full stack runbook.
• Rollback and safe environment removal.
• Reconfigure the foundation and complete deferred configuration.
• Identity and capability profiles, hosted runtime access, and health, logs and recovery.

Run lifecycle commands from the platform root with the intended azd environment selected. Record the deployed revision and approved inputs before changing them. Environment removal is a separate destructive task, not a rollback procedure.

For multi-resource-group deployments, preserve the approved destination mapping on retries and inventory every target before cleanup. A predown safety hook blocks azd down when the destinations span distinct groups for Bicep.

For Terraform, preserve the original common group/application bindings, terraform-resource-groups.json and terraform-backend.json on every runner. The guard verifies those records before native state-scoped destroy across recorded owned/BYO groups; it does not perform imperative group deletion. Follow Terraform removal for preview and explicit destruction.

Where automatic removal is blocked, use separately authorized, itemized cleanup after owner review, preserving shared resources and required data.

For ingestion selection and safe retirement, see Ingestion. For private-link and shared-source controls, see Network isolation and permission options.