# DeploymentScriptError: The provided script failed with multiple errors

## TL;DR
The deployment script resource ran your script and the script itself failed. The fix is in the script, not the template. Pull the script logs, find what the script did wrong, fix it, and redeploy.

## The error
```
DeploymentScriptError: The provided script failed with multiple errors. Please check the deployment script logs.
```

## Fix it
1. Pull the script logs: `az deployment-scripts show-log --name [script-name] --resource-group [rg]`. Expected: the actual script output and errors appear.
2. Read the log from the top. The first error is usually the cause; later errors are fallout. Expected: you find the failing command.
3. Fix the script: missing tools in the script environment, wrong paths, auth failures inside the script. Expected: the script runs clean locally or in a matching container.
4. Check the script's timeout and cleanup settings. Long scripts can get killed and report as multiple errors. Expected: the timeout covers the script's real runtime.
5. Redeploy. Expected: the deployment script resource succeeds.

## When to use this
- An agent sees DeploymentScriptError during a Bicep or ARM deployment.
- Landing-zone or bootstrap templates that run Azure CLI or PowerShell inline.

## When NOT to use this
- Plain DeploymentFailed with no script involved. List the operations instead.
- Script failures outside ARM (pipeline tasks, local runs). Different tooling.

## Compatibility
- Azure deployment scripts (Microsoft.Resources/deploymentScripts), Bicep, ARM templates.

### Variant phrasings
- "DeploymentScriptError"
- "The provided script failed"

## Root cause
Deployment scripts run in a container with a time limit. The error aggregates whatever the script printed to stderr, so "multiple errors" usually means one root failure plus cascading follow-ons. The azure-landing-zones issue hit this on a bootstrap script and resolved it by reading the script logs and fixing the script content.

## Edge cases
- Scripts that need Azure access must use the managed identity the deployment script resource provides. A script that works locally with your login fails in the deployment without it.
- Log retention is limited. Pull logs soon after the failure.