{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "slug": "dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists", "url": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/" }, "title": "Resolve an ARM managed-identity reference after its owning resource exists", "summary": "Check what a reference names before adding retries to a failed deployment.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:47+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.", "dse_recommendation": "DSE recommends tracing the failed lookup back to its template expression before adding retries.", "primary_source": { "name": "Resource not found errors - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft warns that passing a managed identity’s name to reference can cause Resource Manager to resolve it before the resource and identity are deployed. Its guidance is to pass the name of the resource carrying the identity, so deployment occurs before the reference is resolved. Microsoft Learn.

\n

Applicability

\n

Use this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.

\n

DSE recommendation

\n

DSE recommends tracing the failed lookup back to its template expression before adding retries. Compare the expression and deployment order with the current source’s example. Have the template owner propose the smallest correction and preserve a copy of the failed deployment’s diagnostics. Test the correction in an isolated deployment with no production role changes.

\n

Verification

\n

Inspect deployment operations to confirm the owning resource exists before the identity value is consumed. Check that the returned identifier belongs to the intended resource, then test the downstream operation that uses it. Retain the expression, relevant operation order and sanitized identifier comparison so the fix is demonstrably more than a successful rerun.

\n

Official references

\n

Microsoft Learn: Resource not found errors.

", "content_text": "Source facts\nMicrosoft warns that passing a managed identity’s name to reference can cause Resource Manager to resolve it before the resource and identity are deployed. Its guidance is to pass the name of the resource carrying the identity, so deployment occurs before the reference is resolved. Microsoft Learn.\nApplicability\nUse this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.\nDSE recommendation\nDSE recommends tracing the failed lookup back to its template expression before adding retries. Compare the expression and deployment order with the current source’s example. Have the template owner propose the smallest correction and preserve a copy of the failed deployment’s diagnostics. Test the correction in an isolated deployment with no production role changes.\nVerification\nInspect deployment operations to confirm the owning resource exists before the identity value is consumed. Check that the returned identifier belongs to the intended resource, then test the downstream operation that uses it. Retain the expression, relevant operation order and sanitized identifier comparison so the fix is demonstrably more than a successful rerun.\nOfficial references\nMicrosoft Learn: Resource not found errors.", "content_markdown": "## Source facts\n\nMicrosoft warns that passing a managed identity’s name to reference can cause Resource Manager to resolve it before the resource and identity are deployed. Its guidance is to pass the name of the resource carrying the identity, so deployment occurs before the reference is resolved. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found).\n\n## Applicability\n\nUse this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.\n\n## DSE recommendation\n\nDSE recommends tracing the failed lookup back to its template expression before adding retries. Compare the expression and deployment order with the current source’s example. Have the template owner propose the smallest correction and preserve a copy of the failed deployment’s diagnostics. Test the correction in an isolated deployment with no production role changes.\n\n## Verification\n\nInspect deployment operations to confirm the owning resource exists before the identity value is consumed. Check that the returned identifier belongs to the intended resource, then test the downstream operation that uses it. Retain the expression, relevant operation order and sanitized identifier comparison so the fix is demonstrably more than a successful rerun.\n\n## Official references\n\n[Microsoft Learn: Resource not found errors](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "url": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Resolve an ARM managed-identity reference after its owning resource exists", "item": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "url": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/", "headline": "Resolve an ARM managed-identity reference after its owning resource exists", "description": "Check what a reference names before adding retries to a failed deployment.", "abstract": "Check what a reference names before adding retries to a failed deployment.", "articleBody": "Source facts\nMicrosoft warns that passing a managed identity’s name to reference can cause Resource Manager to resolve it before the resource and identity are deployed. Its guidance is to pass the name of the resource carrying the identity, so deployment occurs before the reference is resolved. Microsoft Learn.\nApplicability\nUse this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.\nDSE recommendation\nDSE recommends tracing the failed lookup back to its template expression before adding retries. Compare the expression and deployment order with the current source’s example. Have the template owner propose the smallest correction and preserve a copy of the failed deployment’s diagnostics. Test the correction in an isolated deployment with no production role changes.\nVerification\nInspect deployment operations to confirm the owning resource exists before the identity value is consumed. Check that the returned identifier belongs to the intended resource, then test the downstream operation that uses it. Retain the expression, relevant operation order and sanitized identifier comparison so the fix is demonstrably more than a successful rerun.\nOfficial references\nMicrosoft Learn: Resource not found errors.", "datePublished": "2026-09-17T16:34:47+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Resolve an ARM managed-identity reference after its owning resource exists" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Resource not found errors - Azure Resource Manager | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found" } } ] } }