# Build management-group custom policy IDs with the correct ARM resource scope

> Which ARM resource-ID function distinguishes a management-group custom policy definition from a built-in definition?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:23:57+00:00
- Modified: 2026-09-10T02:08:05+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Which ARM resource-ID function distinguishes a management-group custom policy definition from a built-in definition?

## Potentially affected

JSON ARM templates that refer to custom policy definitions deployed at Azure management-group scope.

## DSE recommendation

DSE recommends checking the definition's ownership scope before constructing its policyDefinitionId.

## Article

## Source facts

A custom Azure Policy definition deployed to a management group is an extension of that group. Microsoft’s ARM guidance uses extensionResourceId() to identify it, with the management group’s fully qualified resource ID as the first argument. Built-in definitions instead belong at tenant scope and use tenantResourceId(). The two identifiers therefore should not be constructed as though their definitions share the same owning resource. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group).

## Applicability

Apply this review to JSON ARM templates that create or reference management-group custom definitions. Identify whether the intended definition is custom or built-in before copying an expression from another assignment. Keep the definition’s ID separate from the name chosen for the assignment itself.

## DSE recommendation

DSE recommends checking the definition’s ownership scope before constructing its policyDefinitionId. Record the expected management-group ID for a custom definition and review the complete expression, including its first argument. Avoid replacing that argument with a subscription or deployment resource-group ID merely because those values are already available elsewhere in the template. Review reused expressions when moving a policy between organizational scopes.

## Verification

Resolve the constructed ID through a read-only check and inspect the returned definition’s name and rule before an authorized assignment change. Compare the result with the approved policy artifact, not only its display label. In a test deployment, inspect the assignment’s recorded definition ID. Retain that evidence with the template revision so an unintended reference can be distinguished from an issue in the policy rule itself.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group). Source retrieved September 9, 2026.

## Primary reference

- Name: Deploy resources to management group - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-to-management-group
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Build management-group custom policy IDs with the correct ARM resource scope,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-479-build-management-group-custom-policy-ids-with-the-correct-arm-resource-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.