# Use an ARM discriminator when an input tag selects a different object schema

> Review the tag-to-schema mapping instead of accepting one loosely specified object for every mode.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:22:47+00:00
- Modified: 2026-09-10T02:11:19+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Review the tag-to-schema mapping instead of accepting one loosely specified object for every mode.

## Potentially affected

ARM JSON templates using languageVersion 2.0 type definitions.

## DSE recommendation

DSE recommends documenting the tag and its corresponding schema together.

## Article

## Source facts

ARM type definitions are available with languageVersion 2.0 and allow a type to be reused. A discriminator chooses the applicable schema from a designated property. Microsoft’s example maps one tag to integer-valued properties and another to string-valued properties, rejecting an object that mixes the wrong shape with the selected tag. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions).

## Applicability

Consider this design when one input object represents alternative configuration modes. Identify the property that chooses the mode and list the fields and types required for each alternative. Keep that contract distinct from a single object that merely permits optional fields.

## DSE recommendation

DSE recommends documenting the tag and its corresponding schema together. Review each alternative with the module’s callers, including how a mode change affects the accompanying fields. Prefer a deliberate mapping over assuming that an object accepted for one mode is suitable for all others. Keep unrelated configuration variants out of the same type unless there is a clear reason to share their contract.

## Verification

Build synthetic examples for every supported tag and then cross-pair a tag with another alternative’s fields or value types. Validate those cases against the exact template version, including an unsupported tag and a missing selector. Record the intended acceptance result before execution and compare it with the actual result. Recheck all alternatives when the mapping changes so adding one mode does not silently redefine another.

## Official references

[Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions). Source retrieved September 9, 2026.

## Primary reference

- Name: Type definitions in templates - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/definitions
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use an ARM discriminator when an input tag selects a different object schema,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-549-use-an-arm-discriminator-when-an-input-tag-selects-a-different-object-schema/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.