# Preserve a policy expression through ARM template evaluation

> Check whether Resource Manager evaluated a function that was intended for Azure Policy.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:25+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Check whether Resource Manager evaluated a function that was intended for Azure Policy.

## Potentially affected

Use this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.

## DSE recommendation

DSE recommends annotating the intended evaluation stage for each dynamic expression in the change review.

## Article

## Source facts

Microsoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general).

## Applicability

Use this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.

## DSE recommendation

DSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.

## Verification

Inspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.

## Official references

[Microsoft Learn: Troubleshoot common errors](https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general).

## Primary reference

- Name: Troubleshoot common errors - Azure Policy | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Preserve a policy expression through ARM template evaluation,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-095-preserve-a-policy-expression-through-arm-template-evaluation/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.