{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "slug": "dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members", "url": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/" }, "title": "Use Azure Policy count conditions to test individual array members", "summary": "Verify that a policy checks the intended members of a resource-property array.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:45+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 213, "potentially_affected": "Apply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array's presence alone is not the acceptance criterion.", "dse_recommendation": "DSE recommends writing a small truth table before publishing the definition.", "primary_source": { "name": "Author policies for array properties on resources - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. Microsoft Learn.

\n

Applicability

\n

Apply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.

\n

DSE recommendation

\n

DSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.

\n

Verification

\n

Evaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.

\n

Official references

\n

Microsoft Learn: Author policies for array properties on resources.

", "content_text": "Source facts\nMicrosoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. Microsoft Learn.\nApplicability\nApply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.\nDSE recommendation\nDSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.\nVerification\nEvaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.\nOfficial references\nMicrosoft Learn: Author policies for array properties on resources.", "content_markdown": "## Source facts\n\nMicrosoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays).\n\n## Applicability\n\nApply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.\n\n## DSE recommendation\n\nDSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.\n\n## Verification\n\nEvaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.\n\n## Official references\n\n[Microsoft Learn: Author policies for array properties on resources](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "url": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Use Azure Policy count conditions to test individual array members", "item": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "url": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/", "headline": "Use Azure Policy count conditions to test individual array members", "description": "Verify that a policy checks the intended members of a resource-property array.", "abstract": "Verify that a policy checks the intended members of a resource-property array.", "articleBody": "Source facts\nMicrosoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. Microsoft Learn.\nApplicability\nApply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.\nDSE recommendation\nDSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.\nVerification\nEvaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.\nOfficial references\nMicrosoft Learn: Author policies for array properties on resources.", "datePublished": "2026-09-17T16:34:45+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Use Azure Policy count conditions to test individual array members" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 213, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Author policies for array properties on resources - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays" } } ] } }