# Guard short input before calling substring in an Azure Policy rule

> Separate a deliberate policy result from a template-function error.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:14+00:00
- Modified: 2026-09-17T16:35:04+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Separate a deliberate policy result from a template-function error.

## Potentially affected

Use this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.

## DSE recommendation

DSE recommends building test inputs around the expression's boundary: shorter than required, exactly the boundary length and longer examples that both match and fail.

## Article

## Source facts

Microsoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule).

## Applicability

Use this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.

## DSE recommendation

DSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.

## Verification

Compare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.

## Official references

[Microsoft Learn: Details of the policy definition structure policy rules](https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule).

## Primary reference

- Name: Details of the policy definition structure policy rules - Azure Policy | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure-policy-rule
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Guard short input before calling substring in an Azure Policy rule,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-046-guard-short-input-before-calling-substring-in-an-azure-policy-rule/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.