{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "slug": "dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope", "url": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/" }, "title": "Build management-group custom policy IDs with the correct ARM resource scope", "summary": "Which ARM resource-ID function distinguishes a management-group custom policy definition from a built-in definition?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:23:57+00:00", "modified_at": "2026-09-10T02:08:05+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 248, "potentially_affected": "JSON ARM templates that refer to custom policy definitions deployed at Azure management-group scope.", "dse_recommendation": "DSE recommends checking the definition's ownership scope before constructing its policyDefinitionId.", "primary_source": { "name": "Deploy resources to management group - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

A custom Azure Policy definition deployed to a management group is an extension of that group. Microsoft’s ARM guidance uses extensionResourceId() to identify it, with the management group’s fully qualified resource ID as the first argument. Built-in definitions instead belong at tenant scope and use tenantResourceId(). The two identifiers therefore should not be constructed as though their definitions share the same owning resource. Microsoft Learn.

\n

Applicability

\n

Apply this review to JSON ARM templates that create or reference management-group custom definitions. Identify whether the intended definition is custom or built-in before copying an expression from another assignment. Keep the definition’s ID separate from the name chosen for the assignment itself.

\n

DSE recommendation

\n

DSE recommends checking the definition’s ownership scope before constructing its policyDefinitionId. Record the expected management-group ID for a custom definition and review the complete expression, including its first argument. Avoid replacing that argument with a subscription or deployment resource-group ID merely because those values are already available elsewhere in the template. Review reused expressions when moving a policy between organizational scopes.

\n

Verification

\n

Resolve the constructed ID through a read-only check and inspect the returned definition’s name and rule before an authorized assignment change. Compare the result with the approved policy artifact, not only its display label. In a test deployment, inspect the assignment’s recorded definition ID. Retain that evidence with the template revision so an unintended reference can be distinguished from an issue in the policy rule itself.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nA custom Azure Policy definition deployed to a management group is an extension of that group. Microsoft’s ARM guidance uses extensionResourceId() to identify it, with the management group’s fully qualified resource ID as the first argument. Built-in definitions instead belong at tenant scope and use tenantResourceId(). The two identifiers therefore should not be constructed as though their definitions share the same owning resource. Microsoft Learn.\nApplicability\nApply this review to JSON ARM templates that create or reference management-group custom definitions. Identify whether the intended definition is custom or built-in before copying an expression from another assignment. Keep the definition’s ID separate from the name chosen for the assignment itself.\nDSE recommendation\nDSE recommends checking the definition’s ownership scope before constructing its policyDefinitionId. Record the expected management-group ID for a custom definition and review the complete expression, including its first argument. Avoid replacing that argument with a subscription or deployment resource-group ID merely because those values are already available elsewhere in the template. Review reused expressions when moving a policy between organizational scopes.\nVerification\nResolve the constructed ID through a read-only check and inspect the returned definition’s name and rule before an authorized assignment change. Compare the result with the approved policy artifact, not only its display label. In a test deployment, inspect the assignment’s recorded definition ID. Retain that evidence with the template revision so an unintended reference can be distinguished from an issue in the policy rule itself.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nA custom Azure Policy definition deployed to a management group is an extension of that group. Microsoft’s ARM guidance uses extensionResourceId() to identify it, with the management group’s fully qualified resource ID as the first argument. Built-in definitions instead belong at tenant scope and use tenantResourceId(). The two identifiers therefore should not be constructed as though their definitions share the same owning resource. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group).\n\n## Applicability\n\nApply this review to JSON ARM templates that create or reference management-group custom definitions. Identify whether the intended definition is custom or built-in before copying an expression from another assignment. Keep the definition’s ID separate from the name chosen for the assignment itself.\n\n## DSE recommendation\n\nDSE recommends checking the definition’s ownership scope before constructing its policyDefinitionId. Record the expected management-group ID for a custom definition and review the complete expression, including its first argument. Avoid replacing that argument with a subscription or deployment resource-group ID merely because those values are already available elsewhere in the template. Review reused expressions when moving a policy between organizational scopes.\n\n## Verification\n\nResolve the constructed ID through a read-only check and inspect the returned definition’s name and rule before an authorized assignment change. Compare the result with the approved policy artifact, not only its display label. In a test deployment, inspect the assignment’s recorded definition ID. Retain that evidence with the template revision so an unintended reference can be distinguished from an issue in the policy rule itself.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Build management-group custom policy IDs with the correct ARM resource scope", "item": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/", "headline": "Build management-group custom policy IDs with the correct ARM resource scope", "description": "Which ARM resource-ID function distinguishes a management-group custom policy definition from a built-in definition?", "abstract": "Which ARM resource-ID function distinguishes a management-group custom policy definition from a built-in definition?", "articleBody": "Source facts\nA custom Azure Policy definition deployed to a management group is an extension of that group. Microsoft’s ARM guidance uses extensionResourceId() to identify it, with the management group’s fully qualified resource ID as the first argument. Built-in definitions instead belong at tenant scope and use tenantResourceId(). The two identifiers therefore should not be constructed as though their definitions share the same owning resource. Microsoft Learn.\nApplicability\nApply this review to JSON ARM templates that create or reference management-group custom definitions. Identify whether the intended definition is custom or built-in before copying an expression from another assignment. Keep the definition’s ID separate from the name chosen for the assignment itself.\nDSE recommendation\nDSE recommends checking the definition’s ownership scope before constructing its policyDefinitionId. Record the expected management-group ID for a custom definition and review the complete expression, including its first argument. Avoid replacing that argument with a subscription or deployment resource-group ID merely because those values are already available elsewhere in the template. Review reused expressions when moving a policy between organizational scopes.\nVerification\nResolve the constructed ID through a read-only check and inspect the returned definition’s name and rule before an authorized assignment change. Compare the result with the approved policy artifact, not only its display label. In a test deployment, inspect the assignment’s recorded definition ID. Retain that evidence with the template revision so an unintended reference can be distinguished from an issue in the policy rule itself.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:23:57+00:00", "dateModified": "2026-09-10T02:08:05+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Build management-group custom policy IDs with the correct ARM resource scope" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 248, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Deploy resources to management group - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group" } } ] } }