{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "slug": "dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result", "url": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/" }, "title": "Identify the related resource behind an Azure Policy compliance result", "summary": "For existence-check policies, Last evaluated resource can point to the related resource defined in the policy rather than the initially selected asset.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "managed-it", "label": "Managed IT operations", "alt": "A controlled technology lifecycle progressing from assessment to approved production.", "card_url": "https://update.dsesecurity.com/assets/editorial/managed-it-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/managed-it-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:46+00:00", "modified_at": "2026-09-10T02:04:57+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 231, "potentially_affected": "Azure Policy compliance investigations involving auditIfNotExists or deployIfNotExists definitions.", "dse_recommendation": "Read the definition's related-resource requirements before proposing a change to the selected asset.", "primary_source": { "name": "Determine causes of non-compliance - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For auditIfNotExists and deployIfNotExists, compliance details include the definition’s details.type and optional existence-check properties. Last evaluated resource refers to a related resource from that details section.

\n

Viewing current property values requires the read operation for the resource type; secret values are masked. Compliance details explain the present non-compliance reason, not when the responsible change occurred. Microsoft identifies change history as a separate preview experience. Microsoft Learn.

\n

Applicability

\n

Identify the policy assignment, definition revision, selected resource and related resource named in the evaluation. Keep missing evidence caused by read access separate from the policy’s actual failure reason.

\n

DSE recommendation

\n

DSE recommends tracing the existence condition to the precise related object before opening remediation work. Compare expected and observed properties and note whether the required object is missing or does not meet the condition. Avoid changing an unrelated VM or service merely because its name appears on the compliance page. Preserve masked values as masked rather than requesting secrets to complete the review.

\n

Verification

\n

Use an approved representative evaluation to confirm the related-resource identity and reason. After the authorized correction, recheck the same assignment and condition and compare the resource state independently. Record the evaluation time separately from any established change time. If chronology is needed, collect the supported historical evidence without inventing it from the current compliance result.

\n

Official references

\n

Microsoft Learn: Determine causes of non-compliance. Source retrieved September 9, 2026.

", "content_text": "Source facts\nFor auditIfNotExists and deployIfNotExists, compliance details include the definition’s details.type and optional existence-check properties. Last evaluated resource refers to a related resource from that details section.\nViewing current property values requires the read operation for the resource type; secret values are masked. Compliance details explain the present non-compliance reason, not when the responsible change occurred. Microsoft identifies change history as a separate preview experience. Microsoft Learn.\nApplicability\nIdentify the policy assignment, definition revision, selected resource and related resource named in the evaluation. Keep missing evidence caused by read access separate from the policy’s actual failure reason.\nDSE recommendation\nDSE recommends tracing the existence condition to the precise related object before opening remediation work. Compare expected and observed properties and note whether the required object is missing or does not meet the condition. Avoid changing an unrelated VM or service merely because its name appears on the compliance page. Preserve masked values as masked rather than requesting secrets to complete the review.\nVerification\nUse an approved representative evaluation to confirm the related-resource identity and reason. After the authorized correction, recheck the same assignment and condition and compare the resource state independently. Record the evaluation time separately from any established change time. If chronology is needed, collect the supported historical evidence without inventing it from the current compliance result.\nOfficial references\nMicrosoft Learn: Determine causes of non-compliance. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nFor auditIfNotExists and deployIfNotExists, compliance details include the definition’s details.type and optional existence-check properties. Last evaluated resource refers to a related resource from that details section.\n\nViewing current property values requires the read operation for the resource type; secret values are masked. Compliance details explain the present non-compliance reason, not when the responsible change occurred. Microsoft identifies change history as a separate preview experience. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance).\n\n## Applicability\n\nIdentify the policy assignment, definition revision, selected resource and related resource named in the evaluation. Keep missing evidence caused by read access separate from the policy’s actual failure reason.\n\n## DSE recommendation\n\nDSE recommends tracing the existence condition to the precise related object before opening remediation work. Compare expected and observed properties and note whether the required object is missing or does not meet the condition. Avoid changing an unrelated VM or service merely because its name appears on the compliance page. Preserve masked values as masked rather than requesting secrets to complete the review.\n\n## Verification\n\nUse an approved representative evaluation to confirm the related-resource identity and reason. After the authorized correction, recheck the same assignment and condition and compare the resource state independently. Record the evaluation time separately from any established change time. If chronology is needed, collect the supported historical evidence without inventing it from the current compliance result.\n\n## Official references\n\n[Microsoft Learn: Determine causes of non-compliance](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "url": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Identify the related resource behind an Azure Policy compliance result", "item": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "url": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/", "headline": "Identify the related resource behind an Azure Policy compliance result", "description": "For existence-check policies, Last evaluated resource can point to the related resource defined in the policy rather than the initially selected asset.", "abstract": "For existence-check policies, Last evaluated resource can point to the related resource defined in the policy rather than the initially selected asset.", "articleBody": "Source facts\nFor auditIfNotExists and deployIfNotExists, compliance details include the definition’s details.type and optional existence-check properties. Last evaluated resource refers to a related resource from that details section.\nViewing current property values requires the read operation for the resource type; secret values are masked. Compliance details explain the present non-compliance reason, not when the responsible change occurred. Microsoft identifies change history as a separate preview experience. Microsoft Learn.\nApplicability\nIdentify the policy assignment, definition revision, selected resource and related resource named in the evaluation. Keep missing evidence caused by read access separate from the policy’s actual failure reason.\nDSE recommendation\nDSE recommends tracing the existence condition to the precise related object before opening remediation work. Compare expected and observed properties and note whether the required object is missing or does not meet the condition. Avoid changing an unrelated VM or service merely because its name appears on the compliance page. Preserve masked values as masked rather than requesting secrets to complete the review.\nVerification\nUse an approved representative evaluation to confirm the related-resource identity and reason. After the authorized correction, recheck the same assignment and condition and compare the resource state independently. Record the evaluation time separately from any established change time. If chronology is needed, collect the supported historical evidence without inventing it from the current compliance result.\nOfficial references\nMicrosoft Learn: Determine causes of non-compliance. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:24:46+00:00", "dateModified": "2026-09-10T02:04:57+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-430-identify-the-related-resource-behind-an-azure-policy-compliance-result/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/managed-it-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Identify the related resource behind an Azure Policy compliance result" }, "articleSection": [ "Cybersecurity", "Networks & Infrastructure" ], "keywords": [ "Cybersecurity", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 231, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Determine causes of non-compliance - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance" } } ] } }