{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "slug": "dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema", "url": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/" }, "title": "Use an ARM discriminator when an input tag selects a different object schema", "summary": "Review the tag-to-schema mapping instead of accepting one loosely specified object for every mode.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:22:47+00:00", "modified_at": "2026-09-10T02:11:19+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 233, "potentially_affected": "ARM JSON templates using languageVersion 2.0 type definitions.", "dse_recommendation": "DSE recommends documenting the tag and its corresponding schema together.", "primary_source": { "name": "Type definitions in templates - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

ARM type definitions are available with languageVersion 2.0 and allow a type to be reused. A discriminator chooses the applicable schema from a designated property. Microsoft’s example maps one tag to integer-valued properties and another to string-valued properties, rejecting an object that mixes the wrong shape with the selected tag. Microsoft Learn.

\n

Applicability

\n

Consider this design when one input object represents alternative configuration modes. Identify the property that chooses the mode and list the fields and types required for each alternative. Keep that contract distinct from a single object that merely permits optional fields.

\n

DSE recommendation

\n

DSE recommends documenting the tag and its corresponding schema together. Review each alternative with the module’s callers, including how a mode change affects the accompanying fields. Prefer a deliberate mapping over assuming that an object accepted for one mode is suitable for all others. Keep unrelated configuration variants out of the same type unless there is a clear reason to share their contract.

\n

Verification

\n

Build synthetic examples for every supported tag and then cross-pair a tag with another alternative’s fields or value types. Validate those cases against the exact template version, including an unsupported tag and a missing selector. Record the intended acceptance result before execution and compare it with the actual result. Recheck all alternatives when the mapping changes so adding one mode does not silently redefine another.

\n

Official references

\n

Microsoft Learn. Source retrieved September 9, 2026.

", "content_text": "Source facts\nARM type definitions are available with languageVersion 2.0 and allow a type to be reused. A discriminator chooses the applicable schema from a designated property. Microsoft’s example maps one tag to integer-valued properties and another to string-valued properties, rejecting an object that mixes the wrong shape with the selected tag. Microsoft Learn.\nApplicability\nConsider this design when one input object represents alternative configuration modes. Identify the property that chooses the mode and list the fields and types required for each alternative. Keep that contract distinct from a single object that merely permits optional fields.\nDSE recommendation\nDSE recommends documenting the tag and its corresponding schema together. Review each alternative with the module’s callers, including how a mode change affects the accompanying fields. Prefer a deliberate mapping over assuming that an object accepted for one mode is suitable for all others. Keep unrelated configuration variants out of the same type unless there is a clear reason to share their contract.\nVerification\nBuild synthetic examples for every supported tag and then cross-pair a tag with another alternative’s fields or value types. Validate those cases against the exact template version, including an unsupported tag and a missing selector. Record the intended acceptance result before execution and compare it with the actual result. Recheck all alternatives when the mapping changes so adding one mode does not silently redefine another.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "content_markdown": "## Source facts\n\nARM type definitions are available with languageVersion 2.0 and allow a type to be reused. A discriminator chooses the applicable schema from a designated property. Microsoft’s example maps one tag to integer-valued properties and another to string-valued properties, rejecting an object that mixes the wrong shape with the selected tag. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions).\n\n## Applicability\n\nConsider this design when one input object represents alternative configuration modes. Identify the property that chooses the mode and list the fields and types required for each alternative. Keep that contract distinct from a single object that merely permits optional fields.\n\n## DSE recommendation\n\nDSE recommends documenting the tag and its corresponding schema together. Review each alternative with the module’s callers, including how a mode change affects the accompanying fields. Prefer a deliberate mapping over assuming that an object accepted for one mode is suitable for all others. Keep unrelated configuration variants out of the same type unless there is a clear reason to share their contract.\n\n## Verification\n\nBuild synthetic examples for every supported tag and then cross-pair a tag with another alternative’s fields or value types. Validate those cases against the exact template version, including an unsupported tag and a missing selector. Record the intended acceptance result before execution and compare it with the actual result. Recheck all alternatives when the mapping changes so adding one mode does not silently redefine another.\n\n## Official references\n\n[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions). Source retrieved September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "url": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use an ARM discriminator when an input tag selects a different object schema", "item": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "url": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/", "headline": "Use an ARM discriminator when an input tag selects a different object schema", "description": "Review the tag-to-schema mapping instead of accepting one loosely specified object for every mode.", "abstract": "Review the tag-to-schema mapping instead of accepting one loosely specified object for every mode.", "articleBody": "Source facts\nARM type definitions are available with languageVersion 2.0 and allow a type to be reused. A discriminator chooses the applicable schema from a designated property. Microsoft’s example maps one tag to integer-valued properties and another to string-valued properties, rejecting an object that mixes the wrong shape with the selected tag. Microsoft Learn.\nApplicability\nConsider this design when one input object represents alternative configuration modes. Identify the property that chooses the mode and list the fields and types required for each alternative. Keep that contract distinct from a single object that merely permits optional fields.\nDSE recommendation\nDSE recommends documenting the tag and its corresponding schema together. Review each alternative with the module’s callers, including how a mode change affects the accompanying fields. Prefer a deliberate mapping over assuming that an object accepted for one mode is suitable for all others. Keep unrelated configuration variants out of the same type unless there is a clear reason to share their contract.\nVerification\nBuild synthetic examples for every supported tag and then cross-pair a tag with another alternative’s fields or value types. Validate those cases against the exact template version, including an unsupported tag and a missing selector. Record the intended acceptance result before execution and compare it with the actual result. Recheck all alternatives when the mapping changes so adding one mode does not silently redefine another.\nOfficial references\nMicrosoft Learn. Source retrieved September 9, 2026.", "datePublished": "2026-09-10T00:22:47+00:00", "dateModified": "2026-09-10T02:11:19+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use an ARM discriminator when an input tag selects a different object schema" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 233, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Type definitions in templates - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions" } } ] } }