Fix: Cyren-SentinelOne workspaceResourceId ARM deployment error (InvalidTemplate on workspace name)#13990
Merged
v-atulyadav merged 9 commits intoAzure:masterfrom Apr 7, 2026
Conversation
…les('workspace-name') to fix ARM deployment error
When deploying from Content Hub, the inner Logic App template was evaluating
[[resourceId('...workspaces', parameters('workspace'))] incorrectly, causing:
'InvalidTemplate: The string character t at position 61 is not expected'
Fix: reference variables('workspace-name') which is [parameters('workspace')] at
outer evaluation scope — same pattern used in live TacitRed-SentinelOne connector.
mazamizo21
pushed a commit
to mazamizo21/Azure-Sentinel
that referenced
this pull request
Apr 3, 2026
…rs('workspace') — same fix as Cyren-SentinelOne PR Azure#13990
mazamizo21
pushed a commit
to mazamizo21/Azure-Sentinel
that referenced
this pull request
Apr 3, 2026
…ment fix (same as Cyren-SentinelOne PR Azure#13990)
…plate compatibility
…) to fix ARM InvalidTemplate error
v-maheshbh
approved these changes
Apr 7, 2026
v-atulyadav
approved these changes
Apr 7, 2026
mazamizo21
pushed a commit
to mazamizo21/Azure-Sentinel
that referenced
this pull request
Apr 19, 2026
) Per reviewer pattern scraped from TacitRed-Defender Azure#13266 + Cyren-SentinelOne Azure#13657 merged commits: 1. Add missing `hidden-SentinelWorkspaceId` tag on Logic App resource (required for Content Hub template visibility — both TacitRed-IOC-CrowdStrike and Cyren-SentinelOne merged have this tag; we were missing it). 2. Define `workspace-name` + `workspaceResourceId` variables inside the nested playbook deployment template (matching Cyren-SentinelOne pattern post-Azure#13990 workspaceResourceId fix). 3. Bump Logic App tag version 1.0 → 1.0.0 (matches merged Cyren + TacitRed convention). 4. Fix broken logo URL: data443_logo.svg (404) → vaikora_logo.png (also added the PNG to Logos/ for this branch). 5. Fix createUiDefinition + Solution_*.json URL width attribute glue bug. 6. Fix solutionId format: vaikora-security-center-connector → azure-sentinel-solution-vaikora-security-center (matches data443riskmitigationinc1761580347231.azure-sentinel-solution-* pattern from all merged solutions). 7. Rebuild 3.0.0.zip with mainTemplate + createUiDefinition only (no testParameters, no Finder duplicates).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
When deploying the Cyren-SentinelOne connector from Content Hub, deployment fails with:
The workspace name was being inlined as a bare identifier instead of a quoted string reference.
Root Cause
In the inner Logic App template (
contentTemplates.properties.mainTemplate), theworkspaceResourceIdvariable usedparameters('workspace')directly inside a double-bracket[[expression:In the TemplateSpec/contentTemplate evaluation context,
parameters('workspace')inside[[does not resolve the parameter value at inner template deployment time — it inlines the value as a bare identifier, breaking ARMs expression parser.Fix
Changed to use
variables('workspace-name')instead, whereworkspace-name = [parameters('workspace')]is evaluated at outer scope. This is the exact same pattern used in the live TacitRed-SentinelOne connector (merged and verified working on Content Hub).Files Changed
Solutions/Cyren-SentinelOne-ThreatIntelligence/Package/mainTemplate.json— 1 line changeSolutions/Cyren-SentinelOne-ThreatIntelligence/Package/3.0.1.zip— rebuilt with corrected templateVerification
workspace-namevariable indirection) ✅