Preserve a policy expression through ARM template evaluation

Source facts

Microsoft describes escaping a policy-function string with an extra opening bracket when embedding it in an ARM template. Resource Manager then treats the expression as a string while processing the template, allowing Azure Policy to receive and evaluate the intended function dynamically. Microsoft Learn.

Applicability

Use this review for a policy definition deployed through an ARM template. Identify which expressions should execute during deployment and which should remain in the policy rule for later evaluation. This is an expression-boundary problem, not a general instruction to escape every template value.

DSE recommendation

DSE recommends annotating the intended evaluation stage for each dynamic expression in the change review. Compare the submitted template with the resulting stored policy definition. Use a small non-enforcing test assignment and representative resource context to confirm the function remains dynamic. Keep a known-good definition available before modifying an existing policy delivery process.

Verification

Inspect the deployed policy text to confirm the intended function is present rather than replaced with a deployment-time value. Evaluate it against two approved resource contexts that should yield different inputs and compare the results with the policy’s purpose. Record both the stored expression and observed evaluations. Investigate a constant result before enabling enforcement or broadening assignment scope.

Official references

Microsoft Learn: Troubleshoot common errors.