# Investigate reference-based changes in ARM what-if output before treating them as real differences

> An unresolved expression can produce a predicted property change.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:13+00:00
- Modified: 2026-09-17T16:42:35+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

An unresolved expression can produce a predicted property change.

## Potentially affected

Use this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.

## DSE recommendation

DSE recommends annotating the affected prediction with the unresolved expression and the expected value's source.

## Article

## Source facts

Microsoft states that ARM what-if cannot resolve the reference function. It compares the current property value with the unresolved template expression and reports a change. During deployment, the property changes only if that expression resolves to a different value. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if).

## Applicability

Use this review for a specific what-if property difference involving reference. Identify the expression and the resource it reads. Do not classify every predicted difference as noise; the source describes this particular limitation, while other differences may represent real changes.

## DSE recommendation

DSE recommends annotating the affected prediction with the unresolved expression and the expected value’s source. Have the deployment owner inspect that referenced resource through an authorized read. Keep the explanation attached to the preview instead of suppressing the whole resource from review. Where the outcome remains uncertain, use a representative isolated deployment before approval.

## Verification

Compare the referenced value with the current target property and record the result at the preview’s review time. In an approved rehearsal, inspect the deployed property’s actual value and compare it with the prediction. Retain any remaining unexplained differences as open findings. A successful explanation for one reference expression should not clear unrelated deletion or modification predictions.

## Official references

[Microsoft Learn: Template deployment what-if](https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if).

## Primary reference

- Name: Template deployment what-if - Azure Resource Manager | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/deploy-what-if
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Investigate reference-based changes in ARM what-if output before treating them as real differences,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-107-investigate-reference-based-changes-in-arm-what-if-output-before-treating-them-as/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.