title: referencing a KeyVault secret in an ARM template fails with 'The resource is not defined in the template'
body: <p>I am trying to create a KeyVault reference in the AppConfig section of an Azure web app.
  The KeyVault reference references a secret which exists in a KeyVault which is part of a different resourcegroup and thus does not exist in the template.</p>
  
  <p>according to the <a href="https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource#reference" rel="nofollow noreferrer">documentation</a> of the reference() template function you should be able to reference a resource which is not part of the template as long as you provide the complete resourceId and the apiVersion.</p>
  
  <p>But when I use that to reference the secret I keep getting a validation error which says:</p>
  
  <blockquote>
    <p>Error: Code=InvalidTemplate; Message=Deployment template validation
    failed: 'The resource
    'Microsoft.KeyVault/vaults//secrets/' is not
    defined in the template.</p>
  </blockquote>
  
  <p>I followed <a href="https://docs.microsoft.com/en-us/azure/app-service/app-service-key-vault-references#reference-syntax" rel="nofollow noreferrer">this guide</a>. for how to use KeyVault references in ARM templates.</p>
  
  <p>Below code is a sample of a situation which does not work.</p>
  
  <pre><code>{
    "type": "Microsoft.Web/sites",
    "apiVersion": "2016-08-01",
    "name": "[variables('webAppName')]",
    "location": "[resourceGroup().location]",
    "properties": {
      "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', variables('serverFarmName'))]",
      "siteConfig": {
        "alwaysOn": true,
        "appSettings": [
          {
            "name": "&lt;secretName&gt;",
            "value": "[concat('@Microsoft.KeyVault(SecretUri=', reference(variables('secretResourceId')).secretUriWithVersion, ')')]"
          },
        ]
      }
    },
    "identity": {
      "type": "SystemAssigned"
    },
    "dependsOn": [
      "[resourceId('Microsoft.Web/serverfarms', variables('serverFarmName'))]"
    ]
  }
  </code></pre>
  
  <p>The variable is defined like this:</p>
  
  <pre><code>"variables": {
    "secretResourceId": "[resourceId(subscription().subscriptionId, parameters('keyVaultResourceGroup'), 'Microsoft.KeyVault/vaults/secrets', parameters('keyVaultName'), 'secretName')]"
  },
  </code></pre>
  
  <p>Is this something specific to references to KeyVault secrets? </p>
  
  <p>As soon as I try the same but with a keyvault and secret inside the template it works perfectly fine.</p>