# Resolve an ARM managed-identity reference after its owning resource exists

> Check what a reference names before adding retries to a failed deployment.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:47+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Check what a reference names before adding retries to a failed deployment.

## Potentially affected

Use this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.

## DSE recommendation

DSE recommends tracing the failed lookup back to its template expression before adding retries.

## Article

## Source facts

Microsoft warns that passing a managed identity’s name to reference can cause Resource Manager to resolve it before the resource and identity are deployed. Its guidance is to pass the name of the resource carrying the identity, so deployment occurs before the reference is resolved. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found).

## Applicability

Use this review for the documented identity-reference failure during an ARM deployment. Identify whether the identity is attached to the resource being created and inspect the exact expression. Do not generalize this example to every independently created identity or every resource-not-found error.

## DSE recommendation

DSE recommends tracing the failed lookup back to its template expression before adding retries. Compare the expression and deployment order with the current source’s example. Have the template owner propose the smallest correction and preserve a copy of the failed deployment’s diagnostics. Test the correction in an isolated deployment with no production role changes.

## Verification

Inspect deployment operations to confirm the owning resource exists before the identity value is consumed. Check that the returned identifier belongs to the intended resource, then test the downstream operation that uses it. Retain the expression, relevant operation order and sanitized identifier comparison so the fix is demonstrably more than a successful rerun.

## Official references

[Microsoft Learn: Resource not found errors](https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found).

## Primary reference

- Name: Resource not found errors - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/troubleshooting/error-not-found
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Resolve an ARM managed-identity reference after its owning resource exists,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-013-resolve-an-arm-managed-identity-reference-after-its-owning-resource-exists/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.