Use Azure Policy count conditions to test individual array members

Source facts

Microsoft explains that an Azure Policy count expression evaluates its where condition once for each array member. Each iteration treats the selected member as the array’s available member for that evaluation. The result counts the members whose condition is true, allowing conditions on individual members. Microsoft Learn.

Applicability

Apply this review when a proposed policy must distinguish matching members within a resource array. Identify the exact alias, the predicate and whether the intended decision concerns any, all or a particular number of members. An array’s presence alone is not the acceptance criterion.

DSE recommendation

DSE recommends writing a small truth table before publishing the definition. Include empty, single-member, all-matching and mixed-member examples appropriate to the intended resource. Ask an independent reviewer to translate the policy back into ordinary language and compare it with that table. Begin with a non-enforcing assessment and retain the previous definition.

Verification

Evaluate representative resources for every approved example and compare the matching-member count with the intended decision. Investigate a mixed array in particular so one acceptable member does not conceal an unacceptable one. Preserve sanitized resource payloads and evaluation results before any enforcement decision, and record the predicate that each example was intended to exercise.

Official references

Microsoft Learn: Author policies for array properties on resources.