# Keep runtime resource lookups out of ARM parameter defaults

> Place a proposed default in the correct evaluation phase before changing deployment order.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:24:25+00:00
- Modified: 2026-09-10T02:08:04+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Place a proposed default in the correct evaluation phase before changing deployment order.

## Potentially affected

Azure Resource Manager JSON templates with parameter default expressions.

## DSE recommendation

DSE recommends separating caller-supplied inputs from values that must be discovered during resource processing.

## Article

## Source facts

Resource Manager settles parameter values before deployment operations begin. ARM parameter defaults therefore cannot use reference or list functions to retrieve runtime resource state. A default can use another parameter, but not a template variable. Expressions are supported for defaults, not for the other parameter properties. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters).

## Applicability

Apply this review when a reusable template tries to discover an existing or newly deployed resource while establishing its inputs. Identify exactly where the expression appears; the question here is parameter evaluation, not whether the resource can be queried elsewhere.

## DSE recommendation

DSE recommends separating caller-supplied inputs from values that must be discovered during resource processing. For each proposed default, record what it depends on and when that dependency becomes available. Where the caller must supply the value, make that obligation clear instead of hiding it behind an invalid default. Do not treat an added deployment dependency as a substitute for reviewing the parameter expression itself.

## Verification

Use a small, nonproduction template to check the proposed default and a supported parameter-to-parameter alternative. Keep any runtime lookup out of the parameter definition during the comparison. Verify both the explicitly supplied and omitted-input paths, and retain validation diagnostics with the template revision. Confirm the resulting value matches the intended configuration before carrying the revised input design into a resource deployment.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters). Source retrieved September 9, 2026.

## Primary reference

- Name: Parameters in templates - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/parameters
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Keep runtime resource lookups out of ARM parameter defaults,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-451-keep-runtime-resource-lookups-out-of-arm-parameter-defaults/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.