{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "slug": "dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation", "url": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/" }, "title": "Preserve a policy expression through ARM template evaluation", "summary": "Check whether Resource Manager evaluated a function that was intended for Azure Policy.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:33:25+00:00", "modified_at": "2026-09-17T16:38:46+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 212, "potentially_affected": "Use this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.", "dse_recommendation": "DSE recommends annotating the intended evaluation stage for each dynamic expression in the change review.", "primary_source": { "name": "Troubleshoot common errors - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Microsoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. Microsoft Learn.

\n

Applicability

\n

Use this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.

\n

DSE recommendation

\n

DSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.

\n

Verification

\n

Inspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.

\n

Official references

\n

Microsoft Learn: Troubleshoot common errors.

", "content_text": "Source facts\nMicrosoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. Microsoft Learn.\nApplicability\nUse this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.\nDSE recommendation\nDSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.\nVerification\nInspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.\nOfficial references\nMicrosoft Learn: Troubleshoot common errors.", "content_markdown": "## Source facts\n\nMicrosoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general).\n\n## Applicability\n\nUse this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.\n\n## DSE recommendation\n\nDSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.\n\n## Verification\n\nInspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.\n\n## Official references\n\n[Microsoft Learn: Troubleshoot common errors](https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general)." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Preserve a policy expression through ARM template evaluation", "item": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "url": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/", "headline": "Preserve a policy expression through ARM template evaluation", "description": "Check whether Resource Manager evaluated a function that was intended for Azure Policy.", "abstract": "Check whether Resource Manager evaluated a function that was intended for Azure Policy.", "articleBody": "Source facts\nMicrosoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. Microsoft Learn.\nApplicability\nUse this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.\nDSE recommendation\nDSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.\nVerification\nInspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.\nOfficial references\nMicrosoft Learn: Troubleshoot common errors.", "datePublished": "2026-09-17T16:33:25+00:00", "dateModified": "2026-09-17T16:38:46+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Preserve a policy expression through ARM template evaluation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 212, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Troubleshoot common errors - Azure Policy | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general" } } ] } }