{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "slug": "dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults", "url": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/" }, "title": "Keep runtime resource lookups out of ARM parameter defaults", "summary": "Place a proposed default in the correct evaluation phase before changing deployment order.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:24:25+00:00", "modified_at": "2026-09-10T02:08:04+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 226, "potentially_affected": "Azure Resource Manager JSON templates with parameter default expressions.", "dse_recommendation": "DSE recommends separating caller-supplied inputs from values that must be discovered during resource processing.", "primary_source": { "name": "Parameters in templates - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Resource Manager settles parameter values before deployment operations begin. ARM parameter defaults therefore cannot use reference or list functions to retrieve runtime resource state. A default can use another parameter, but not a template variable. Expressions are supported for defaults, not for the other parameter properties. Microsoft Learn.

\n

Applicability

\n

Apply this review when a reusable template tries to discover an existing or newly deployed resource while establishing its inputs. Identify exactly where the expression appears; the question here is parameter evaluation, not whether the resource can be queried elsewhere.

\n

DSE recommendation

\n

DSE recommends separating caller-supplied inputs from values that must be discovered during resource processing. For each proposed default, record what it depends on and when that dependency becomes available. Where the caller must supply the value, make that obligation clear instead of hiding it behind an invalid default. Do not treat an added deployment dependency as a substitute for reviewing the parameter expression itself.

\n

Verification

\n

Use a small, nonproduction template to check the proposed default and a supported parameter-to-parameter alternative. Keep any runtime lookup out of the parameter definition during the comparison. Verify both the explicitly supplied and omitted-input paths, and retain validation diagnostics with the template revision. Confirm the resulting value matches the intended configuration before carrying the revised input design into a resource deployment.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nResource Manager settles parameter values before deployment operations begin. ARM parameter defaults therefore cannot use reference or list functions to retrieve runtime resource state. A default can use another parameter, but not a template variable. Expressions are supported for defaults, not for the other parameter properties. Microsoft Learn.\nApplicability\nApply this review when a reusable template tries to discover an existing or newly deployed resource while establishing its inputs. Identify exactly where the expression appears; the question here is parameter evaluation, not whether the resource can be queried elsewhere.\nDSE recommendation\nDSE recommends separating caller-supplied inputs from values that must be discovered during resource processing. For each proposed default, record what it depends on and when that dependency becomes available. Where the caller must supply the value, make that obligation clear instead of hiding it behind an invalid default. Do not treat an added deployment dependency as a substitute for reviewing the parameter expression itself.\nVerification\nUse a small, nonproduction template to check the proposed default and a supported parameter-to-parameter alternative. Keep any runtime lookup out of the parameter definition during the comparison. Verify both the explicitly supplied and omitted-input paths, and retain validation diagnostics with the template revision. Confirm the resulting value matches the intended configuration before carrying the revised input design into a resource deployment.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nResource Manager settles parameter values before deployment operations begin. ARM parameter defaults therefore cannot use reference or list functions to retrieve runtime resource state. A default can use another parameter, but not a template variable. Expressions are supported for defaults, not for the other parameter properties. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters).\n\n## Applicability\n\nApply this review when a reusable template tries to discover an existing or newly deployed resource while establishing its inputs. Identify exactly where the expression appears; the question here is parameter evaluation, not whether the resource can be queried elsewhere.\n\n## DSE recommendation\n\nDSE recommends separating caller-supplied inputs from values that must be discovered during resource processing. For each proposed default, record what it depends on and when that dependency becomes available. Where the caller must supply the value, make that obligation clear instead of hiding it behind an invalid default. Do not treat an added deployment dependency as a substitute for reviewing the parameter expression itself.\n\n## Verification\n\nUse a small, nonproduction template to check the proposed default and a supported parameter-to-parameter alternative. Keep any runtime lookup out of the parameter definition during the comparison. Verify both the explicitly supplied and omitted-input paths, and retain validation diagnostics with the template revision. Confirm the resulting value matches the intended configuration before carrying the revised input design into a resource deployment.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "url": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Keep runtime resource lookups out of ARM parameter defaults", "item": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "url": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/", "headline": "Keep runtime resource lookups out of ARM parameter defaults", "description": "Place a proposed default in the correct evaluation phase before changing deployment order.", "abstract": "Place a proposed default in the correct evaluation phase before changing deployment order.", "articleBody": "Source facts\nResource Manager settles parameter values before deployment operations begin. ARM parameter defaults therefore cannot use reference or list functions to retrieve runtime resource state. A default can use another parameter, but not a template variable. Expressions are supported for defaults, not for the other parameter properties. Microsoft Learn.\nApplicability\nApply this review when a reusable template tries to discover an existing or newly deployed resource while establishing its inputs. Identify exactly where the expression appears; the question here is parameter evaluation, not whether the resource can be queried elsewhere.\nDSE recommendation\nDSE recommends separating caller-supplied inputs from values that must be discovered during resource processing. For each proposed default, record what it depends on and when that dependency becomes available. Where the caller must supply the value, make that obligation clear instead of hiding it behind an invalid default. Do not treat an added deployment dependency as a substitute for reviewing the parameter expression itself.\nVerification\nUse a small, nonproduction template to check the proposed default and a supported parameter-to-parameter alternative. Keep any runtime lookup out of the parameter definition during the comparison. Verify both the explicitly supplied and omitted-input paths, and retain validation diagnostics with the template revision. Confirm the resulting value matches the intended configuration before carrying the revised input design into a resource deployment.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:24:25+00:00", "dateModified": "2026-09-10T02:08:04+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Keep runtime resource lookups out of ARM parameter defaults" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 226, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Parameters in templates - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters" } } ] } }