# Use Azure Policy count conditions to test individual array members

> Verify that a policy checks the intended members of a resource-property array.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:45+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Verify that a policy checks the intended members of a resource-property array.

## Potentially affected

Apply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array's presence alone is not the acceptance criterion.

## DSE recommendation

DSE recommends writing a small truth table before publishing the definition.

## Article

## Source facts

Microsoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays).

## Applicability

Apply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.

## DSE recommendation

DSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.

## Verification

Evaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.

## Official references

[Microsoft Learn: Author policies for array properties on resources](https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays).

## Primary reference

- Name: Author policies for array properties on resources - Azure Policy | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/policy/how-to/author-policies-for-arrays
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use Azure Policy count conditions to test individual array members,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-015-use-azure-policy-count-conditions-to-test-individual-array-members/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.