'Azure Policy Template : How to compare a value of a subscription tag in policy ExistenceCondition

I want to retrieve an Azure tag defined on subscription level and compare this value with a resource property. This comparaison will be done on ExistenceCondition of the policy. My block code is as below:

          "existenceCondition": {
            "allOf": [
              {
                "field": "Microsoft.Insights/diagnosticSettings/metrics.enabled",
                "equals": "True"
              },
              {
                "field": "Microsoft.Insights/diagnosticSettings/workspaceId",
                "equals": "[if(equals(field('location'),'westus'), reference(concat('/subscriptions/', subscription().subscriptionId, '/providers/Microsoft.Resources/tags/default'), '2019-10-01').tags.mytagc, 'mylawid' ) )]"
              }
            ]
}
 

With this code, I edit the policy but I get the error below: Editing policy definition 'Deploy Diagnostic Settings for APP Service Plans to Log Analytics workspace' failed. A function or parameter could not be validated. If using template functions, try following the tips in: https://aka.ms/policy-avoiding-template-failures. The inner exception 'The function 'reference' defined in policy is invalid. Please see https://aka.ms/policy-functions for usage details.'.

By reading the error log, I ask if we can use reference function in the ExistenceCondition? In the Azure doc, it is written that the reference function can only be used in the properties of a resource definition and the outputs section of a template or deployment.

If not, is there another way to do this comparison?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source