Guard short input before calling substring in an Azure Policy rule

Source facts

Microsoft demonstrates an Azure Policy rule that checks a name’s length with if before calling substring. For a name shorter than the requested prefix, the guarded expression returns another value instead of raising an evaluation error. The short name can still fail the intended policy condition. Microsoft Learn.

Applicability

Use this review for a custom rule that derives a value from resource input, particularly a naming rule that takes a fixed-length prefix. Identify the minimum input length and the intended decision for shorter values before changing the expression.

DSE recommendation

DSE recommends building test inputs around the expression’s boundary: shorter than required, exactly the boundary length and longer examples that both match and fail. Make the fallback result explicit and have another reviewer verify that it expresses the intended rule. Evaluate the revised definition in an approved non-enforcing test scope before considering enforcement.

Verification

Compare the evaluation result for each input with the written expectation. Confirm that short input produces an ordinary policy outcome instead of a function error, and that valid-length mismatches are still detected. Preserve the expression and test resource examples with the change. A successful matching example alone is insufficient evidence for this boundary condition.

Official references

Microsoft Learn: Details of the policy definition structure policy rules.