{
    "api_version": "1",
    "kind": "dse_post",
    "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
    "item": {
        "id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
        "slug": "dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as",
        "url": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
        "alternate_urls": {
            "markdown": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as.md",
            "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/"
        },
        "title": "Investigate reference-based changes in ARM what-if output before treating them as real differences",
        "summary": "An unresolved expression can produce a predicted property change.",
        "format": {
            "slug": "guide",
            "name": "Guide"
        },
        "priority": {
            "slug": "info",
            "name": "Information"
        },
        "featured": false,
        "image": {
            "theme": "cyber-defense",
            "label": "Cyber defense",
            "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.",
            "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20",
            "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20",
            "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
            "width": 2400,
            "height": 1350
        },
        "topics": [
            {
                "slug": "cybersecurity",
                "name": "Cybersecurity",
                "url": "https://update.dsesecurity.com/topic/cybersecurity/"
            },
            {
                "slug": "it",
                "name": "IT",
                "url": "https://update.dsesecurity.com/topic/it/"
            }
        ],
        "author": {
            "name": "DSE Security Editorial Team",
            "url": "https://update.dsesecurity.com/#editorial-team",
            "type": "Organization"
        },
        "publisher": {
            "name": "Detection Systems & Engineering",
            "url": "https://dsesecurity.com/"
        },
        "published_at": "2026-09-17T16:33:13+00:00",
        "modified_at": "2026-09-17T16:42:35+00:00",
        "reviewed_on": "2026-09-17",
        "reading_minutes": 1,
        "word_count": 205,
        "potentially_affected": "Use this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.",
        "dse_recommendation": "DSE recommends annotating the affected prediction with the unresolved expression and the expected value's source.",
        "primary_source": {
            "name": "Template deployment what-if - Azure Resource Manager | Microsoft Learn",
            "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if",
            "published_on": null,
            "authority": "Microsoft Learn"
        },
        "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
        "usage_info": "https://update.dsesecurity.com/usage/",
        "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
        "content_html": "<h2>Source facts</h2>\n<p>Microsoft states that ARM what-if cannot resolve the reference function. It compares the current property value with the unresolved template expression and reports a change. During deployment, the property changes only if that expression resolves to a different value. <a href=\"https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn</a>.</p>\n<h2>Applicability</h2>\n<p>Use this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.</p>\n<h2>DSE recommendation</h2>\n<p>DSE recommends annotating the affected prediction with the unresolved expression and the expected value&#8217;s source. Have the deployment owner inspect that referenced resource through an authorized read. Keep the explanation attached to the preview instead of suppressing the whole resource from review. Where the outcome remains uncertain, use a representative isolated deployment before approval.</p>\n<h2>Verification</h2>\n<p>Compare the referenced value with the current target property and record the result at the preview&#8217;s review time. In an approved rehearsal, inspect the deployed property&#8217;s actual value and compare it with the prediction. Retain any remaining unexplained differences as open findings. A successful explanation for one reference expression should not clear unrelated deletion or modification predictions.</p>\n<h2>Official references</h2>\n<p><a href=\"https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if\" target=\"_blank\" rel=\"noopener noreferrer\">Microsoft Learn: Template deployment what-if</a>.</p>",
        "content_text": "Source facts\nMicrosoft states that ARM what-if cannot resolve the reference function. It compares the current property value with the unresolved template expression and reports a change. During deployment, the property changes only if that expression resolves to a different value. Microsoft Learn.\nApplicability\nUse this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.\nDSE recommendation\nDSE recommends annotating the affected prediction with the unresolved expression and the expected value’s source. Have the deployment owner inspect that referenced resource through an authorized read. Keep the explanation attached to the preview instead of suppressing the whole resource from review. Where the outcome remains uncertain, use a representative isolated deployment before approval.\nVerification\nCompare the referenced value with the current target property and record the result at the preview’s review time. In an approved rehearsal, inspect the deployed property’s actual value and compare it with the prediction. Retain any remaining unexplained differences as open findings. A successful explanation for one reference expression should not clear unrelated deletion or modification predictions.\nOfficial references\nMicrosoft Learn: Template deployment what-if.",
        "content_markdown": "## Source facts\n\nMicrosoft states that ARM what-if cannot resolve the reference function. It compares the current property value with the unresolved template expression and reports a change. During deployment, the property changes only if that expression resolves to a different value. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if).\n\n## Applicability\n\nUse this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.\n\n## DSE recommendation\n\nDSE recommends annotating the affected prediction with the unresolved expression and the expected value’s source. Have the deployment owner inspect that referenced resource through an authorized read. Keep the explanation attached to the preview instead of suppressing the whole resource from review. Where the outcome remains uncertain, use a representative isolated deployment before approval.\n\n## Verification\n\nCompare the referenced value with the current target property and record the result at the preview’s review time. In an approved rehearsal, inspect the deployed property’s actual value and compare it with the prediction. Retain any remaining unexplained differences as open findings. A successful explanation for one reference expression should not clear unrelated deletion or modification predictions.\n\n## Official references\n\n[Microsoft Learn: Template deployment what-if](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if)."
    },
    "json_ld": {
        "@context": "https://schema.org",
        "@graph": [
            {
                "@type": "Organization",
                "@id": "https://dsesecurity.com/#organization",
                "name": "Detection Systems & Engineering",
                "alternateName": "DSE Security",
                "url": "https://dsesecurity.com/",
                "logo": {
                    "@type": "ImageObject",
                    "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20"
                }
            },
            {
                "@type": "Organization",
                "@id": "https://update.dsesecurity.com/#editorial-team",
                "name": "DSE Security Editorial Team",
                "url": "https://update.dsesecurity.com/",
                "parentOrganization": {
                    "@id": "https://dsesecurity.com/#organization"
                }
            },
            {
                "@type": "WebSite",
                "@id": "https://update.dsesecurity.com/#website",
                "name": "DSE Updates",
                "alternateName": "DSE Security Knowledge Hub",
                "url": "https://update.dsesecurity.com/",
                "inLanguage": "en-US",
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "potentialAction": {
                    "@type": "SearchAction",
                    "target": {
                        "@type": "EntryPoint",
                        "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}"
                    },
                    "query-input": "required name=search_term_string"
                }
            },
            {
                "@type": "WebPage",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
                "isPartOf": {
                    "@id": "https://update.dsesecurity.com/#website"
                },
                "lastReviewed": "2026-09-17"
            },
            {
                "@type": "BreadcrumbList",
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/#breadcrumbs",
                "itemListElement": [
                    {
                        "@type": "ListItem",
                        "position": 1,
                        "name": "DSE Updates",
                        "item": "https://update.dsesecurity.com/"
                    },
                    {
                        "@type": "ListItem",
                        "position": 2,
                        "name": "Investigate reference-based changes in ARM what-if output before treating them as real differences",
                        "item": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/"
                    }
                ]
            },
            {
                "@type": [
                    "Article",
                    "TechArticle"
                ],
                "@id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/#article",
                "identifier": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
                "url": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/",
                "headline": "Investigate reference-based changes in ARM what-if output before treating them as real differences",
                "description": "An unresolved expression can produce a predicted property change.",
                "abstract": "An unresolved expression can produce a predicted property change.",
                "articleBody": "Source facts\nMicrosoft states that ARM what-if cannot resolve the reference function. It compares the current property value with the unresolved template expression and reports a change. During deployment, the property changes only if that expression resolves to a different value. Microsoft Learn.\nApplicability\nUse this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.\nDSE recommendation\nDSE recommends annotating the affected prediction with the unresolved expression and the expected value’s source. Have the deployment owner inspect that referenced resource through an authorized read. Keep the explanation attached to the preview instead of suppressing the whole resource from review. Where the outcome remains uncertain, use a representative isolated deployment before approval.\nVerification\nCompare the referenced value with the current target property and record the result at the preview’s review time. In an approved rehearsal, inspect the deployed property’s actual value and compare it with the prediction. Retain any remaining unexplained differences as open findings. A successful explanation for one reference expression should not clear unrelated deletion or modification predictions.\nOfficial references\nMicrosoft Learn: Template deployment what-if.",
                "datePublished": "2026-09-17T16:33:13+00:00",
                "dateModified": "2026-09-17T16:42:35+00:00",
                "mainEntityOfPage": {
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/"
                },
                "inLanguage": "en-US",
                "isAccessibleForFree": true,
                "author": {
                    "@type": "Organization",
                    "name": "DSE Security Editorial Team",
                    "url": "https://update.dsesecurity.com/#editorial-team"
                },
                "publisher": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "image": {
                    "@type": "ImageObject",
                    "@id": "https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/#primaryimage",
                    "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20",
                    "width": 1200,
                    "height": 630,
                    "caption": "Investigate reference-based changes in ARM what-if output before treating them as real differences"
                },
                "articleSection": [
                    "Cybersecurity",
                    "IT"
                ],
                "keywords": [
                    "Cybersecurity",
                    "IT",
                    "Guide",
                    "Information priority"
                ],
                "genre": "Guide",
                "about": [
                    {
                        "@type": "Thing",
                        "name": "Cybersecurity",
                        "url": "https://update.dsesecurity.com/topic/cybersecurity/"
                    },
                    {
                        "@type": "Thing",
                        "name": "IT",
                        "url": "https://update.dsesecurity.com/topic/it/"
                    }
                ],
                "wordCount": 205,
                "timeRequired": "PT1M",
                "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/",
                "usageInfo": "https://update.dsesecurity.com/usage/",
                "copyrightHolder": {
                    "@id": "https://dsesecurity.com/#organization"
                },
                "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.",
                "citation": {
                    "@type": "CreativeWork",
                    "name": "Template deployment what-if - Azure Resource Manager | Microsoft Learn",
                    "url": "https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if"
                }
            }
        ]
    }
}