diff --git a/arm/Microsoft.Compute/availabilitySets/deploy.bicep b/arm/Microsoft.Compute/availabilitySets/deploy.bicep
index df0432c78c..1a19d03365 100644
--- a/arm/Microsoft.Compute/availabilitySets/deploy.bicep
+++ b/arm/Microsoft.Compute/availabilitySets/deploy.bicep
@@ -45,7 +45,7 @@ resource availabilitySet 'Microsoft.Compute/availabilitySets@2021-04-01' = {
   properties: {
     platformFaultDomainCount: availabilitySetFaultDomain
     platformUpdateDomainCount: availabilitySetUpdateDomain
-    proximityPlacementGroup: (empty(proximityPlacementGroupId) ? json('null') : proximityPlacementGroupId)
+    proximityPlacementGroup: !empty(proximityPlacementGroupId) ? proximityPlacementGroupId : null
   }
   sku: {
     name: availabilitySetSku
@@ -56,7 +56,7 @@ resource availabilitySet_lock 'Microsoft.Authorization/locks@2016-09-01' = if (l
   name: '${availabilitySet.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: availabilitySet
 }
@@ -69,6 +69,10 @@ module availabilitySet_rbac '.bicep/nested_rbac.bicep' = [for (roleAssignment, i
   }
 }]
 
+@description('The resource group the availability set was deployed into')
 output availabilitySetResourceName string = availabilitySet.name
+
+@description('The resourceId of the availability set')
 output availabilitySetResourceId string = availabilitySet.id
+@description('The name of the availability set')
 output availabilitySetResourceGroup string = resourceGroup().name
diff --git a/arm/Microsoft.Compute/availabilitySets/readme.md b/arm/Microsoft.Compute/availabilitySets/readme.md
index 031bb004e1..36900190f7 100644
--- a/arm/Microsoft.Compute/availabilitySets/readme.md
+++ b/arm/Microsoft.Compute/availabilitySets/readme.md
@@ -66,11 +66,11 @@ Tag names and tag values can be provided as needed. A tag can be left without a
 
 ## Outputs
 
-| Output Name | Type |
-| :-- | :-- |
-| `availabilitySetResourceGroup` | string |
-| `availabilitySetResourceId` | string |
-| `availabilitySetResourceName` | string |
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `availabilitySetResourceGroup` | string | The name of the availability set |
+| `availabilitySetResourceId` | string | The resourceId of the availability set |
+| `availabilitySetResourceName` | string | The resource group the availability set was deployed into |
 
 ## Template references
 
diff --git a/arm/Microsoft.Compute/diskEncryptionSets/deploy.bicep b/arm/Microsoft.Compute/diskEncryptionSets/deploy.bicep
index 877cfb3e33..07997cd723 100644
--- a/arm/Microsoft.Compute/diskEncryptionSets/deploy.bicep
+++ b/arm/Microsoft.Compute/diskEncryptionSets/deploy.bicep
@@ -19,15 +19,13 @@ param tags object = {}
 @description('Optional. Customer Usage Attribution id (GUID). This GUID must be previously registered')
 param cuaId string = ''
 
-var keyVaultName = last(split(keyVaultId, '/'))
-
 module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
   name: 'pid-${cuaId}'
   params: {}
 }
 
 resource keyVaultAccessPolicies 'Microsoft.KeyVault/vaults/accessPolicies@2019-09-01' = {
-  name: '${keyVaultName}/add'
+  name: '${last(split(keyVaultId, '/'))}/add'
   properties: {
     accessPolicies: [
       {
@@ -72,7 +70,17 @@ module diskEncryptionSet_rbac '.bicep/nested_rbac.bicep' = [for (roleAssignment,
   }
 }]
 
+@description('The resourceId of the disk encryption set')
 output diskEncryptionSetResourceId string = diskEncryptionSet.id
+
+@description('The name of the disk encryption set')
+output diskEncryptionSetName string = diskEncryptionSet.name
+
+@description('The principal Id of the disk encryption set')
 output principalId string = reference('Microsoft.Compute/diskEncryptionSets/${diskEncryptionSetName}', '2020-12-01', 'Full').identity.principalId
-output keyVaultName string = keyVaultName
+
+@description('The name of the key vault with the disk encryption key')
+output keyVaultName string = last(split(keyVaultId, '/'))
+
+@description('The resource group the disk encryption set was deployed into')
 output diskEncryptionResourceGroup string = resourceGroup().name
diff --git a/arm/Microsoft.Compute/diskEncryptionSets/readme.md b/arm/Microsoft.Compute/diskEncryptionSets/readme.md
index e33d091c71..a54c369722 100644
--- a/arm/Microsoft.Compute/diskEncryptionSets/readme.md
+++ b/arm/Microsoft.Compute/diskEncryptionSets/readme.md
@@ -70,12 +70,13 @@ Tag names and tag values can be provided as needed. A tag can be left without a
 
 ## Outputs
 
-| Output Name | Type |
-| :-- | :-- |
-| `diskEncryptionResourceGroup` | string |
-| `diskEncryptionSetResourceId` | string |
-| `keyVaultName` | string |
-| `principalId` | string |
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `diskEncryptionResourceGroup` | string | The resource group the disk encryption set was deployed into |
+| `diskEncryptionSetName` | string | The name of the disk encryption set |
+| `diskEncryptionSetResourceId` | string | The resourceId of the disk encryption set |
+| `keyVaultName` | string | The name of the key vault with the disk encryption key |
+| `principalId` | string | The principal Id of the disk encryption set |
 
 ## Template references
 
diff --git a/arm/Microsoft.Compute/images/deploy.bicep b/arm/Microsoft.Compute/images/deploy.bicep
index 54194c8256..ec07d8b16a 100644
--- a/arm/Microsoft.Compute/images/deploy.bicep
+++ b/arm/Microsoft.Compute/images/deploy.bicep
@@ -63,6 +63,11 @@ module image_rbac '.bicep/nested_rbac.bicep' = [for (roleAssignment, index) in r
   }
 }]
 
+@description('The resourceId of the image')
 output imageResourceId string = image.id
+
+@description('The resource group the image was deployed into')
 output imageResourceGroup string = resourceGroup().name
+
+@description('The name of the image')
 output imageName string = image.name
diff --git a/arm/Microsoft.Compute/images/readme.md b/arm/Microsoft.Compute/images/readme.md
index 62d867821b..ca7c7c69f2 100644
--- a/arm/Microsoft.Compute/images/readme.md
+++ b/arm/Microsoft.Compute/images/readme.md
@@ -73,11 +73,11 @@ Tag names and tag values can be provided as needed. A tag can be left without a
 
 ## Outputs
 
-| Output Name | Type |
-| :-- | :-- |
-| `imageName` | string |
-| `imageResourceGroup` | string |
-| `imageResourceId` | string |
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `imageName` | string | The name of the image |
+| `imageResourceGroup` | string | The resource group the image was deployed into |
+| `imageResourceId` | string | The resourceId of the image |
 
 ## Template references
 
diff --git a/arm/Microsoft.Compute/proximityPlacementGroups/deploy.bicep b/arm/Microsoft.Compute/proximityPlacementGroups/deploy.bicep
index dcc7c2d47c..7ffda46e75 100644
--- a/arm/Microsoft.Compute/proximityPlacementGroups/deploy.bicep
+++ b/arm/Microsoft.Compute/proximityPlacementGroups/deploy.bicep
@@ -46,7 +46,7 @@ resource proximityPlacementGroup_lock 'Microsoft.Authorization/locks@2016-09-01'
   name: '${proximityPlacementGroup.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: proximityPlacementGroup
 }
@@ -59,6 +59,11 @@ module proximityPlacementGroup_rbac '.bicep/nested_rbac.bicep' = [for (roleAssig
   }
 }]
 
-output proximityPlacementGroupResourceName string = proximityPlacementGroup.name
+@description('The name of the proximity placement group')
+output proximityPlacementGroupName string = proximityPlacementGroup.name
+
+@description('The resourceId the proximity placement group')
 output proximityPlacementGroupResourceId string = proximityPlacementGroup.id
+
+@description('The resource group the proximity placement group was deployed into')
 output proximityPlacementGroupResourceGroup string = resourceGroup().name
diff --git a/arm/Microsoft.Compute/proximityPlacementGroups/readme.md b/arm/Microsoft.Compute/proximityPlacementGroups/readme.md
index 394efc271c..4e03c3414f 100644
--- a/arm/Microsoft.Compute/proximityPlacementGroups/readme.md
+++ b/arm/Microsoft.Compute/proximityPlacementGroups/readme.md
@@ -63,11 +63,11 @@ Tag names and tag values can be provided as needed. A tag can be left without a
 
 ## Outputs
 
-| Output Name | Type |
-| :-- | :-- |
-| `proximityPlacementGroupResourceGroup` | string |
-| `proximityPlacementGroupResourceId` | string |
-| `proximityPlacementGroupResourceName` | string |
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `proximityPlacementGroupName` | string | The name of the proximity placement group |
+| `proximityPlacementGroupResourceGroup` | string | The resource group the proximity placement group was deployed into |
+| `proximityPlacementGroupResourceId` | string | The resourceId the proximity placement group |
 
 ## Template references
 
diff --git a/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep b/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
index 9ca1f4e47e..4ebeaea522 100644
--- a/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
+++ b/arm/Microsoft.Compute/virtualMachineScaleSets/deploy.bicep
@@ -360,9 +360,9 @@ var linuxConfiguration = {
 var windowsConfiguration = {
   provisionVMAgent: provisionVMAgent
   enableAutomaticUpdates: enableAutomaticUpdates
-  timeZone: (empty(timeZone) ? json('null') : timeZone)
-  additionalUnattendContent: (empty(additionalUnattendContent) ? json('null') : additionalUnattendContent)
-  winRM: (empty(winRMListeners) ? json('null') : json('{"listeners": "${winRMListeners}"}'))
+  timeZone: empty(timeZone) ? null : timeZone
+  additionalUnattendContent: empty(additionalUnattendContent) ? null : additionalUnattendContent
+  winRM: empty(winRMListeners) ? null : json('{"listeners": "${winRMListeners}"}')
 }
 
 var accountSasProperties = {
@@ -379,7 +379,7 @@ module pid_cuaId '.bicep/nested_cuaId.bicep' = if (!empty(cuaId)) {
 }
 
 resource proximityPlacementGroup 'Microsoft.Compute/proximityPlacementGroups@2021-04-01' = if (!empty(proximityPlacementGroupName)) {
-  name: ((!empty(proximityPlacementGroupName)) ? proximityPlacementGroupName : 'dummyProximityGroup')
+  name: !empty(proximityPlacementGroupName) ? proximityPlacementGroupName : 'dummyProximityGroup'
   location: location
   tags: tags
   properties: {
@@ -391,10 +391,10 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = if (!empt
   name: vmssName
   location: location
   tags: tags
-  identity: (empty(managedIdentityType) ? json('null') : json('{"type":"${managedIdentityType}${((!empty(managedIdentityIdentities)) ? ',"userAssignedIdentities":"${managedIdentityIdentities}' : '')}"}'))
+  identity: !empty(managedIdentityType) ? json('{"type":"${managedIdentityType}${((!empty(managedIdentityIdentities)) ? ',"userAssignedIdentities":"${managedIdentityIdentities}' : '')}"}') : null
   zones: availabilityZones
   properties: {
-    proximityPlacementGroup: (empty(proximityPlacementGroupName) ? json('null') : json('{"id":"${resourceId('Microsoft.Compute/proximityPlacementGroups', proximityPlacementGroupName)}"}'))
+    proximityPlacementGroup: !empty(proximityPlacementGroupName) ? json('{"id":"${resourceId('Microsoft.Compute/proximityPlacementGroups', proximityPlacementGroup.name)}"}') : null
     upgradePolicy: {
       mode: upgradePolicyMode
       rollingUpgradePolicy: {
@@ -416,10 +416,10 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = if (!empt
       osProfile: {
         computerNamePrefix: vmNamePrefix
         adminUsername: adminUsername
-        adminPassword: (empty(adminPassword) ? json('null') : adminPassword)
-        customData: (empty(customData) ? json('null') : base64(customData))
-        windowsConfiguration: ((osType == 'Windows') ? windowsConfiguration : json('null'))
-        linuxConfiguration: ((osType == 'Linux') ? linuxConfiguration : json('null'))
+        adminPassword: !empty(adminPassword) ? adminPassword : null
+        customData: !empty(customData) ? base64(customData) : null
+        windowsConfiguration: osType == 'Windows' ? windowsConfiguration : null
+        linuxConfiguration: osType == 'Linux' ? linuxConfiguration : null
         secrets: secrets
       }
       storageProfile: {
@@ -427,15 +427,15 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = if (!empt
         osDisk: {
           createOption: osDisk.createOption
           diskSizeGB: osDisk.diskSizeGB
-          caching: (contains(osDisk, 'caching') ? osDisk.caching : json('null'))
-          writeAcceleratorEnabled: (contains(osDisk, 'writeAcceleratorEnabled') ? osDisk.writeAcceleratorEnabled : json('null'))
-          diffDiskSettings: (contains(osDisk, 'diffDiskSettings') ? osDisk.diffDiskSettings : json('null'))
-          osType: (contains(osDisk, 'osType') ? osDisk.osType : json('null'))
-          image: (contains(osDisk, 'image') ? osDisk.image : json('null'))
-          vhdContainers: (contains(osDisk, 'vhdContainers') ? osDisk.vhdContainers : json('null'))
+          caching: contains(osDisk, 'caching') ? osDisk.caching : null
+          writeAcceleratorEnabled: contains(osDisk, 'writeAcceleratorEnabled') ? osDisk.writeAcceleratorEnabled : null
+          diffDiskSettings: contains(osDisk, 'diffDiskSettings') ? osDisk.diffDiskSettings : null
+          osType: contains(osDisk, 'osType') ? osDisk.osType : null
+          image: contains(osDisk, 'image') ? osDisk.image : null
+          vhdContainers: contains(osDisk, 'vhdContainers') ? osDisk.vhdContainers : null
           managedDisk: {
             storageAccountType: osDisk.managedDisk.storageAccountType
-            diskEncryptionSet: (contains(osDisk, 'diskEncryptionSet') ? osDisk.diskEncryptionSet : json('null'))
+            diskEncryptionSet: contains(osDisk, 'diskEncryptionSet') ? osDisk.diskEncryptionSet : null
           }
         }
         dataDisks: [for (item, j) in dataDisks: {
@@ -443,43 +443,43 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = if (!empt
           diskSizeGB: item.diskSizeGB
           createOption: item.createOption
           caching: item.caching
-          writeAcceleratorEnabled: (contains(osDisk, 'writeAcceleratorEnabled') ? osDisk.writeAcceleratorEnabled : json('null'))
+          writeAcceleratorEnabled: contains(osDisk, 'writeAcceleratorEnabled') ? osDisk.writeAcceleratorEnabled : null
           managedDisk: {
             storageAccountType: item.managedDisk.storageAccountType
             diskEncryptionSet: {
-              id: (enableServerSideEncryption ? item.managedDisk.diskEncryptionSet.id : json('null'))
+              id: enableServerSideEncryption ? item.managedDisk.diskEncryptionSet.id : null
             }
           }
-          diskIOPSReadWrite: (contains(osDisk, 'diskIOPSReadWrite') ? item.diskIOPSReadWrite : json('null'))
-          diskMBpsReadWrite: (contains(osDisk, 'diskMBpsReadWrite') ? item.diskMBpsReadWrite : json('null'))
+          diskIOPSReadWrite: contains(osDisk, 'diskIOPSReadWrite') ? item.diskIOPSReadWrite : null
+          diskMBpsReadWrite: contains(osDisk, 'diskMBpsReadWrite') ? item.diskMBpsReadWrite : null
         }]
       }
       networkProfile: {
         networkInterfaceConfigurations: [for (item, j) in nicConfigurations: {
           name: '${vmssName}${item.nicSuffix}configuration-${j}'
           properties: {
-            primary: ((j == 0) ? true : any(null))
-            enableAcceleratedNetworking: (contains(nicConfigurations, 'enableAcceleratedNetworking') ? item.enableAcceleratedNetworking : json('null'))
-            networkSecurityGroup: (contains(nicConfigurations, 'nsgId') ? json('{"id": "${item.nsgId}"}') : json('null'))
+            primary: (j == 0) ? true : any(null)
+            enableAcceleratedNetworking: contains(nicConfigurations, 'enableAcceleratedNetworking') ? item.enableAcceleratedNetworking : null
+            networkSecurityGroup: contains(nicConfigurations, 'nsgId') ? json('{"id": "${item.nsgId}"}') : null
             ipConfigurations: item.ipConfigurations
           }
         }]
       }
       diagnosticsProfile: {
         bootDiagnostics: {
-          enabled: (!empty(bootDiagnosticStorageAccountName))
-          storageUri: (empty(bootDiagnosticStorageAccountName) ? json('null') : 'https://${bootDiagnosticStorageAccountName}${bootDiagnosticStorageAccountUri}')
+          enabled: !empty(bootDiagnosticStorageAccountName)
+          storageUri: !empty(bootDiagnosticStorageAccountName) ? 'https://${bootDiagnosticStorageAccountName}${bootDiagnosticStorageAccountUri}' : null
         }
       }
-      licenseType: (empty(licenseType) ? json('null') : licenseType)
+      licenseType: empty(licenseType) ? null : licenseType
       priority: vmPriority
-      evictionPolicy: (enableEvictionPolicy ? 'Deallocate' : json('null'))
-      billingProfile: (((!empty(vmPriority)) && (!empty(maxPriceForLowPriorityVm))) ? json('{"maxPrice":"${maxPriceForLowPriorityVm}"}') : json('null'))
+      evictionPolicy: enableEvictionPolicy ? 'Deallocate' : null
+      billingProfile: !empty(vmPriority) && !empty(maxPriceForLowPriorityVm) ? json('{"maxPrice":"${maxPriceForLowPriorityVm}"}') : null
       scheduledEventsProfile: scheduledEventsProfile
     }
     overprovision: overprovision
     doNotRunExtensionsOnOverprovisionedVMs: doNotRunExtensionsOnOverprovisionedVMs
-    zoneBalance: ((zoneBalance == 'true') ? zoneBalance : json('null'))
+    zoneBalance: zoneBalance == 'true' ? zoneBalance : null
     platformFaultDomainCount: scaleSetFaultDomain
     singlePlacementGroup: singlePlacementGroup
     additionalCapabilities: {
@@ -491,17 +491,14 @@ resource vmss 'Microsoft.Compute/virtualMachineScaleSets@2021-04-01' = if (!empt
     name: instanceSize
     capacity: instanceCount
   }
-  plan: (empty(plan) ? json('null') : plan)
-  dependsOn: [
-    proximityPlacementGroup
-  ]
+  plan: !empty(plan) ? plan : null
 }
 
 resource vmss_lock 'Microsoft.Authorization/locks@2016-09-01' = if (lock != 'NotSpecified') {
   name: '${vmss.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: vmss
 }
@@ -551,10 +548,10 @@ resource vmss_WindowsMMAAgent 'Microsoft.Compute/virtualMachineScaleSets/extensi
     typeHandlerVersion: '1.0'
     autoUpgradeMinorVersion: true
     settings: {
-      workspaceId: (empty(workspaceId) ? 'dummy' : reference(workspaceId, '2015-11-01-preview').customerId)
+      workspaceId: empty(workspaceId) ? 'dummy' : reference(workspaceId, '2015-11-01-preview').customerId
     }
     protectedSettings: {
-      workspaceKey: (empty(workspaceId) ? 'dummy' : listKeys(workspaceId, '2015-11-01-preview').primarySharedKey)
+      workspaceKey: empty(workspaceId) ? 'dummy' : listKeys(workspaceId, '2015-11-01-preview').primarySharedKey
     }
   }
   dependsOn: [
@@ -571,10 +568,10 @@ resource vmss_LinuxMMAAgent 'Microsoft.Compute/virtualMachineScaleSets/extension
     typeHandlerVersion: '1.7'
     autoUpgradeMinorVersion: true
     settings: {
-      workspaceId: (empty(workspaceId) ? 'dummy' : reference(workspaceId, '2015-11-01-preview').customerId)
+      workspaceId: empty(workspaceId) ? 'dummy' : reference(workspaceId, '2015-11-01-preview').customerId
     }
     protectedSettings: {
-      workspaceKey: (empty(workspaceId) ? 'dummy' : listKeys(workspaceId, '2015-11-01-preview').primarySharedKey)
+      workspaceKey: empty(workspaceId) ? 'dummy' : listKeys(workspaceId, '2015-11-01-preview').primarySharedKey
     }
   }
   dependsOn: [
@@ -698,7 +695,7 @@ resource vmss_windowsDsc 'Microsoft.Compute/virtualMachineScaleSets/extensions@2
     typeHandlerVersion: '2.77'
     autoUpgradeMinorVersion: true
     settings: dscConfiguration.settings
-    protectedSettings: (contains(dscConfiguration, 'protectedSettings') ? dscConfiguration.protectedSettings : json('null'))
+    protectedSettings: contains(dscConfiguration, 'protectedSettings') ? dscConfiguration.protectedSettings : null
   }
   dependsOn: [
     vmss_NetworkWatcherAgentLinux
@@ -718,9 +715,9 @@ resource vmss_WindowsCustomScriptExtension 'Microsoft.Compute/virtualMachineScal
     }
     protectedSettings: {
       commandToExecute: windowsScriptExtensionCommandToExecute
-      storageAccountName: ((!empty(cseStorageAccountName)) ? cseStorageAccountName : json('null'))
-      storageAccountKey: ((!empty(cseStorageAccountKey)) ? cseStorageAccountKey : json('null'))
-      managedIdentity: ((!empty(cseManagedIdentity)) ? cseManagedIdentity : json('null'))
+      storageAccountName: !empty(cseStorageAccountName) ? cseStorageAccountName : null
+      storageAccountKey: !empty(cseStorageAccountKey) ? cseStorageAccountKey : null
+      managedIdentity: !empty(cseManagedIdentity) ? cseManagedIdentity : null
     }
   }
   dependsOn: [
@@ -731,11 +728,11 @@ resource vmss_WindowsCustomScriptExtension 'Microsoft.Compute/virtualMachineScal
 resource vmss_diagnosticSettings 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = if ((!empty(diagnosticStorageAccountId)) || (!empty(workspaceId)) || (!empty(eventHubAuthorizationRuleId)) || (!empty(eventHubName))) {
   name: '${vmssName}-diagnosticSettings'
   properties: {
-    storageAccountId: (empty(diagnosticStorageAccountId) ? json('null') : diagnosticStorageAccountId)
-    workspaceId: (empty(workspaceId) ? json('null') : workspaceId)
-    eventHubAuthorizationRuleId: (empty(eventHubAuthorizationRuleId) ? json('null') : eventHubAuthorizationRuleId)
-    eventHubName: (empty(eventHubName) ? json('null') : eventHubName)
-    metrics: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? json('null') : diagnosticsMetrics)
+    storageAccountId: empty(diagnosticStorageAccountId) ? null : diagnosticStorageAccountId
+    workspaceId: empty(workspaceId) ? null : workspaceId
+    eventHubAuthorizationRuleId: empty(eventHubAuthorizationRuleId) ? null : eventHubAuthorizationRuleId
+    eventHubName: empty(eventHubName) ? null : eventHubName
+    metrics: empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName) ? null : diagnosticsMetrics
   }
   scope: vmss
 }
@@ -748,6 +745,11 @@ module vmss_rbac '.bicep/nested_rbac.bicep' = [for (roleAssignment, index) in ro
   }
 }]
 
+@description('The resourceID of the virtual machine scale set')
 output vmssResourceIds string = vmss.id
+
+@description('The resource group of the virtual machine scale set')
 output vmssResourceGroup string = resourceGroup().name
+
+@description('The name of the virtual machine scale set')
 output vmssName string = vmssName
diff --git a/arm/Microsoft.Compute/virtualMachineScaleSets/readme.md b/arm/Microsoft.Compute/virtualMachineScaleSets/readme.md
index d219bdaf69..202632856b 100644
--- a/arm/Microsoft.Compute/virtualMachineScaleSets/readme.md
+++ b/arm/Microsoft.Compute/virtualMachineScaleSets/readme.md
@@ -376,11 +376,11 @@ Tag names and tag values can be provided as needed. A tag can be left without a
 
 ## Outputs
 
-| Output Name | Type |
-| :-- | :-- |
-| `vmssName` | string |
-| `vmssResourceGroup` | string |
-| `vmssResourceIds` | string |
+| Output Name | Type | Description |
+| :-- | :-- | :-- |
+| `vmssName` | string | The name of the virtual machine scale set |
+| `vmssResourceGroup` | string | The resource group of the virtual machine scale set |
+| `vmssResourceIds` | string | The resourceID of the virtual machine scale set |
 
 ## Template references
 
diff --git a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_extension.bicep b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_extension.bicep
index f5dfdba56f..d75f180033 100644
--- a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_extension.bicep
+++ b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_extension.bicep
@@ -17,8 +17,8 @@ resource extension 'Microsoft.Compute/virtualMachines/extensions@2021-04-01' = {
     type: type
     typeHandlerVersion: typeHandlerVersion
     autoUpgradeMinorVersion: autoUpgradeMinorVersion
-    forceUpdateTag: !(empty(forceUpdateTag)) ? forceUpdateTag : json('null')
-    settings: !(empty(settings)) ? settings : json('null')
-    protectedSettings: !(empty(protectedSettings)) ? protectedSettings : json('null')
+    forceUpdateTag: !empty(forceUpdateTag) ? forceUpdateTag : null
+    settings: !empty(settings) ? settings : null
+    protectedSettings: !empty(protectedSettings) ? protectedSettings : null
   }
 }
diff --git a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface.bicep b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface.bicep
index be96dfe185..3d54ee4e38 100644
--- a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface.bicep
+++ b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface.bicep
@@ -53,7 +53,7 @@ module networkInterface_publicIPConfigurations 'nested_networkInterface_publicIP
     metricsToEnable: pipMetricsToEnable
     logsToEnable: pipLogsToEnable
     lock: lock
-    roleAssignments: (contains(ipConfiguration.pipconfiguration, 'roleAssignments') ? (!(empty(ipConfiguration.pipconfiguration.roleAssignments)) ? ipConfiguration.pipconfiguration.roleAssignments : json('[]')) : json('[]'))
+    roleAssignments: contains(ipConfiguration.pipconfiguration, 'roleAssignments') ? (!empty(ipConfiguration.pipconfiguration.roleAssignments) ? ipConfiguration.pipconfiguration.roleAssignments : []) : []
     tags: tags
   }
 }]
@@ -65,15 +65,15 @@ resource networkInterface 'Microsoft.Network/networkInterfaces@2021-02-01' = {
   properties: {
     enableIPForwarding: enableIPForwarding
     enableAcceleratedNetworking: enableAcceleratedNetworking
-    dnsSettings: (!empty(dnsServers) ? dnsServersValues : json('null'))
-    networkSecurityGroup: (!empty(networkSecurityGroupId) ? networkSecurityGroup : json('null'))
+    dnsSettings: !empty(dnsServers) ? dnsServersValues : null
+    networkSecurityGroup: !empty(networkSecurityGroupId) ? networkSecurityGroup : null
     ipConfigurations: [for (ipConfiguration, index) in ipConfigurationArray: {
-      name: (!empty(ipConfiguration.name) ? ipConfiguration.name : json('null'))
+      name: !empty(ipConfiguration.name) ? ipConfiguration.name : null
       properties: {
         primary: ((index == 0) ? true : false)
-        privateIPAllocationMethod: (contains(ipConfiguration, 'privateIPAllocationMethod') ? (!empty(ipConfiguration.privateIPAllocationMethod) ? ipConfiguration.privateIPAllocationMethod : json('null')) : json('null'))
-        privateIPAddress: (contains(ipConfiguration, 'vmIPAddress') ? (empty(ipConfiguration.vmIPAddress) ? json('null') : ipConfiguration.vmIPAddress) : json('null'))
-        publicIPAddress: ((contains(ipConfiguration, 'pipconfiguration')) ? json('{"id":"${resourceId('Microsoft.Network/publicIPAddresses', '${virtualMachineName}${ipConfiguration.pipconfiguration.publicIpNameSuffix}')}"}') : json('null'))
+        privateIPAllocationMethod: contains(ipConfiguration, 'privateIPAllocationMethod') ? (!empty(ipConfiguration.privateIPAllocationMethod) ? ipConfiguration.privateIPAllocationMethod : null) : null
+        privateIPAddress: contains(ipConfiguration, 'vmIPAddress') ? (!empty(ipConfiguration.vmIPAddress) ? ipConfiguration.vmIPAddress : null) : null
+        publicIPAddress: contains(ipConfiguration, 'pipconfiguration') ? json('{"id":"${resourceId('Microsoft.Network/publicIPAddresses', '${virtualMachineName}${ipConfiguration.pipconfiguration.publicIpNameSuffix}')}"}') : null
         subnet: {
           id: ipConfiguration.subnetId
         }
@@ -89,7 +89,7 @@ resource networkInterface_lock 'Microsoft.Authorization/locks@2017-04-01' = if (
   name: '${networkInterface.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: networkInterface
 }
@@ -97,11 +97,11 @@ resource networkInterface_lock 'Microsoft.Authorization/locks@2017-04-01' = if (
 resource networkInterface_diagnosticSettings 'Microsoft.Insights/diagnosticsettings@2021-05-01-preview' = if ((!empty(diagnosticStorageAccountId)) || (!empty(workspaceId)) || (!empty(eventHubAuthorizationRuleId)) || (!empty(eventHubName))) {
   name: '${networkInterface.name}-diagnosticSettings'
   properties: {
-    storageAccountId: (empty(diagnosticStorageAccountId) ? json('null') : diagnosticStorageAccountId)
-    workspaceId: (empty(workspaceId) ? json('null') : workspaceId)
-    eventHubAuthorizationRuleId: (empty(eventHubAuthorizationRuleId) ? json('null') : eventHubAuthorizationRuleId)
-    eventHubName: (empty(eventHubName) ? json('null') : eventHubName)
-    metrics: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? json('null') : diagnosticsMetrics)
+    storageAccountId: !empty(diagnosticStorageAccountId) ? diagnosticStorageAccountId : null
+    workspaceId: !empty(workspaceId) ? workspaceId : null
+    eventHubAuthorizationRuleId: !empty(eventHubAuthorizationRuleId) ? eventHubAuthorizationRuleId : null
+    eventHubName: !empty(eventHubName) ? eventHubName : null
+    metrics: !empty(diagnosticStorageAccountId) || !empty(workspaceId) || !empty(eventHubAuthorizationRuleId) || !empty(eventHubName) ? diagnosticsMetrics : null
   }
   scope: networkInterface
 }
diff --git a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface_publicIPAddress.bicep b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface_publicIPAddress.bicep
index 468c73f594..85298282e9 100644
--- a/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface_publicIPAddress.bicep
+++ b/arm/Microsoft.Compute/virtualMachines/.bicep/nested_networkInterface_publicIPAddress.bicep
@@ -48,7 +48,7 @@ resource publicIpAddress 'Microsoft.Network/publicIPAddresses@2021-02-01' = {
   }
   properties: {
     publicIPAllocationMethod: publicIPAllocationMethod
-    publicIPPrefix: ((!empty(publicIPPrefixId)) ? publicIPPrefix : json('null'))
+    publicIPPrefix: ((!empty(publicIPPrefixId)) ? publicIPPrefix : null)
   }
 }
 
@@ -56,7 +56,7 @@ resource publicIpAddress_lock 'Microsoft.Authorization/locks@2017-04-01' = if (l
   name: '${publicIpAddress.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: publicIpAddress
 }
@@ -64,12 +64,12 @@ resource publicIpAddress_lock 'Microsoft.Authorization/locks@2017-04-01' = if (l
 resource publicIpAddress_diagnosticSettings 'Microsoft.Insights/diagnosticsettings@2021-05-01-preview' = if ((!empty(diagnosticStorageAccountId)) || (!empty(workspaceId)) || (!empty(eventHubAuthorizationRuleId)) || (!empty(eventHubName))) {
   name: '${publicIpAddress.name}-diagnosticSettings'
   properties: {
-    storageAccountId: (empty(diagnosticStorageAccountId) ? json('null') : diagnosticStorageAccountId)
-    workspaceId: (empty(workspaceId) ? json('null') : workspaceId)
-    eventHubAuthorizationRuleId: (empty(eventHubAuthorizationRuleId) ? json('null') : eventHubAuthorizationRuleId)
-    eventHubName: (empty(eventHubName) ? json('null') : eventHubName)
-    metrics: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? json('null') : diagnosticsMetrics)
-    logs: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? json('null') : diagnosticsLogs)
+    storageAccountId: (empty(diagnosticStorageAccountId) ? null : diagnosticStorageAccountId)
+    workspaceId: (empty(workspaceId) ? null : workspaceId)
+    eventHubAuthorizationRuleId: (empty(eventHubAuthorizationRuleId) ? null : eventHubAuthorizationRuleId)
+    eventHubName: (empty(eventHubName) ? null : eventHubName)
+    metrics: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? null : diagnosticsMetrics)
+    logs: ((empty(diagnosticStorageAccountId) && empty(workspaceId) && empty(eventHubAuthorizationRuleId) && empty(eventHubName)) ? null : diagnosticsLogs)
   }
   scope: publicIpAddress
 }
diff --git a/arm/Microsoft.Compute/virtualMachines/deploy.bicep b/arm/Microsoft.Compute/virtualMachines/deploy.bicep
index b554a5ac29..adb69c9678 100644
--- a/arm/Microsoft.Compute/virtualMachines/deploy.bicep
+++ b/arm/Microsoft.Compute/virtualMachines/deploy.bicep
@@ -284,11 +284,11 @@ param baseTime string = utcNow('u')
 @description('Optional. SAS token validity length to use to download files from storage accounts. Usage: \'PT8H\' - valid for 8 hours; \'P5D\' - valid for 5 days; \'P1Y\' - valid for 1 year. When not provided, the SAS token will be valid for 8 hours.')
 param sasTokenValidityLength string = 'PT8H'
 
-var vmComputerNameTransformed = ((vmComputerNamesTransformation == 'uppercase') ? toUpper(virtualMachineName) : ((vmComputerNamesTransformation == 'lowercase') ? toLower(virtualMachineName) : virtualMachineName))
+var vmComputerNameTransformed = vmComputerNamesTransformation == 'uppercase' ? toUpper(virtualMachineName) : (vmComputerNamesTransformation == 'lowercase' ? toLower(virtualMachineName) : virtualMachineName)
 
 var identity = {
   type: managedServiceIdentity
-  userAssignedIdentities: (empty(userAssignedIdentities) ? json('null') : userAssignedIdentities)
+  userAssignedIdentities: empty(userAssignedIdentities) ? userAssignedIdentities : null
 }
 
 var accountSasProperties = {
@@ -315,10 +315,10 @@ module virtualMachine_nic '.bicep/nested_networkInterface.bicep' = [for (nicConf
     virtualMachineName: virtualMachineName
     location: location
     tags: tags
-    enableIPForwarding: (contains(nicConfiguration, 'enableIPForwarding') ? (!(empty(nicConfiguration.enableIPForwarding)) ? nicConfiguration.enableIPForwarding : false) : false)
-    enableAcceleratedNetworking: (contains(nicConfiguration, 'enableAcceleratedNetworking') ? (!(empty(nicConfiguration.enableAcceleratedNetworking)) ? nicConfiguration.enableAcceleratedNetworking : false) : false)
-    dnsServers: (contains(nicConfiguration, 'dnsServers') ? (!(empty(nicConfiguration.dnsServers)) ? nicConfiguration.dnsServers : json('[]')) : json('[]'))
-    networkSecurityGroupId: (contains(nicConfiguration, 'nsgId') ? (!(empty(nicConfiguration.nsgId)) ? nicConfiguration.nsgId : '') : '')
+    enableIPForwarding: contains(nicConfiguration, 'enableIPForwarding') ? (!empty(nicConfiguration.enableIPForwarding) ? nicConfiguration.enableIPForwarding : false) : false
+    enableAcceleratedNetworking: contains(nicConfiguration, 'enableAcceleratedNetworking') ? (!empty(nicConfiguration.enableAcceleratedNetworking) ? nicConfiguration.enableAcceleratedNetworking : false) : false
+    dnsServers: contains(nicConfiguration, 'dnsServers') ? (!empty(nicConfiguration.dnsServers) ? nicConfiguration.dnsServers : []) : []
+    networkSecurityGroupId: contains(nicConfiguration, 'nsgId') ? (!empty(nicConfiguration.nsgId) ? nicConfiguration.nsgId : '') : ''
     ipConfigurationArray: nicConfiguration.ipConfigurations
     lock: lock
     diagnosticStorageAccountId: diagnosticStorageAccountId
@@ -329,7 +329,7 @@ module virtualMachine_nic '.bicep/nested_networkInterface.bicep' = [for (nicConf
     metricsToEnable: nicMetricsToEnable
     pipMetricsToEnable: pipMetricsToEnable
     pipLogsToEnable: pipLogsToEnable
-    roleAssignments: (contains(nicConfiguration, 'roleAssignments') ? (!(empty(nicConfiguration.roleAssignments)) ? nicConfiguration.roleAssignments : json('[]')) : json('[]'))
+    roleAssignments: contains(nicConfiguration, 'roleAssignments') ? (!empty(nicConfiguration.roleAssignments) ? nicConfiguration.roleAssignments : []) : []
   }
 }]
 
@@ -338,8 +338,8 @@ resource virtualMachine 'Microsoft.Compute/virtualMachines@2021-04-01' = {
   location: location
   identity: identity
   tags: tags
-  zones: (useAvailabilityZone ? array(availabilityZone) : json('null'))
-  plan: (empty(plan) ? json('null') : plan)
+  zones: useAvailabilityZone ? array(availabilityZone) : null
+  plan: !empty(plan) ? plan : null
   properties: {
     hardwareProfile: {
       vmSize: vmSize
@@ -363,7 +363,7 @@ resource virtualMachine 'Microsoft.Compute/virtualMachines@2021-04-01' = {
         managedDisk: {
           storageAccountType: dataDisk.managedDisk.storageAccountType
           diskEncryptionSet: {
-            id: (enableServerSideEncryption ? dataDisk.managedDisk.diskEncryptionSet.id : json('null'))
+            id: enableServerSideEncryption ? dataDisk.managedDisk.diskEncryptionSet.id : null
           }
         }
       }]
@@ -375,33 +375,33 @@ resource virtualMachine 'Microsoft.Compute/virtualMachines@2021-04-01' = {
       computerName: vmComputerNameTransformed
       adminUsername: adminUsername
       adminPassword: adminPassword
-      customData: (empty(customData) ? json('null') : base64(customData))
-      windowsConfiguration: (empty(windowsConfiguration) ? json('null') : windowsConfiguration)
-      linuxConfiguration: (empty(linuxConfiguration) ? json('null') : linuxConfiguration)
+      customData: !empty(customData) ? base64(customData) : null 
+      windowsConfiguration: !empty(windowsConfiguration) ? windowsConfiguration : null
+      linuxConfiguration: !empty(linuxConfiguration) ? linuxConfiguration : null
       secrets: certificatesToBeInstalled
       allowExtensionOperations: allowExtensionOperations
     }
     networkProfile: {
       networkInterfaces: [for (nicConfiguration, index) in nicConfigurations: {
         properties: {
-          primary: ((index == 0) ? true : false)
+          primary: index == 0 ? true : false
         }
         id: resourceId('Microsoft.Network/networkInterfaces', '${virtualMachineName}${nicConfiguration.nicSuffix}')
       }]
     }
     diagnosticsProfile: {
       bootDiagnostics: {
-        enabled: (!empty(bootDiagnosticStorageAccountName))
-        storageUri: (empty(bootDiagnosticStorageAccountName) ? json('null') : 'https://${bootDiagnosticStorageAccountName}${bootDiagnosticStorageAccountUri}')
+        enabled: !empty(bootDiagnosticStorageAccountName)
+        storageUri: !empty(bootDiagnosticStorageAccountName) ? 'https://${bootDiagnosticStorageAccountName}${bootDiagnosticStorageAccountUri}' : null 
       }
     }
-    availabilitySet: (empty(availabilitySetName) ? json('null') : json('{"id":"${resourceId('Microsoft.Compute/availabilitySets', availabilitySetName)}"}'))
-    proximityPlacementGroup: (empty(proximityPlacementGroupName) ? json('null') : json('{"id":"${resourceId('Microsoft.Compute/proximityPlacementGroups', proximityPlacementGroupName)}"}'))
+    availabilitySet: !empty(availabilitySetName) ? json('{"id":"${resourceId('Microsoft.Compute/availabilitySets', availabilitySetName)}"}') : null
+    proximityPlacementGroup: !empty(proximityPlacementGroupName) ? json('{"id":"${resourceId('Microsoft.Compute/proximityPlacementGroups', proximityPlacementGroupName)}"}') : null
     priority: vmPriority
-    evictionPolicy: (enableEvictionPolicy ? 'Deallocate' : json('null'))
-    billingProfile: (((!empty(vmPriority)) && (!empty(maxPriceForLowPriorityVm))) ? json('{"maxPrice":"${maxPriceForLowPriorityVm}"}') : json('null'))
-    host: ((!empty(dedicatedHostId)) ? json('{"id":"${dedicatedHostId}"}') : json('null'))
-    licenseType: (empty(licenseType) ? json('null') : licenseType)
+    evictionPolicy: enableEvictionPolicy ? 'Deallocate' : null
+    billingProfile: !empty(vmPriority) && !empty(maxPriceForLowPriorityVm) ? json('{"maxPrice":"${maxPriceForLowPriorityVm}"}') : null
+    host: !empty(dedicatedHostId) ? json('{"id":"${dedicatedHostId}"}') : null
+    licenseType: !empty(licenseType) ? licenseType : null
   }
   dependsOn: [
     virtualMachine_nic
@@ -453,10 +453,10 @@ module virtualMachine_microsoftMonitoringAgentExtension '.bicep/nested_extension
     typeHandlerVersion: enableWindowsMMAAgent ? '1.0' : '1.7'
     autoUpgradeMinorVersion: true
     settings: {
-      workspaceId: (!empty(workspaceId)) ? reference(virtualMachine_logAnalyticsWorkspace.id, virtualMachine_logAnalyticsWorkspace.apiVersion).customerId : ''
+      workspaceId: !empty(workspaceId) ? reference(virtualMachine_logAnalyticsWorkspace.id, virtualMachine_logAnalyticsWorkspace.apiVersion).customerId : ''
     }
     protectedSettings: {
-      workspaceKey: (!empty(workspaceId)) ? virtualMachine_logAnalyticsWorkspace.listKeys().primarySharedKey : ''
+      workspaceKey: !empty(workspaceId) ? virtualMachine_logAnalyticsWorkspace.listKeys().primarySharedKey : ''
     }
   }
 }
@@ -513,7 +513,7 @@ module virtualMachine_desiredStateConfigurationExtension '.bicep/nested_extensio
     typeHandlerVersion: '2.77'
     autoUpgradeMinorVersion: true
     settings: desiredStateConfigurationSettings.settings
-    protectedSettings: contains(desiredStateConfigurationSettings, 'protectedSettings') ? desiredStateConfigurationSettings.protectedSettings : json('null')
+    protectedSettings: contains(desiredStateConfigurationSettings, 'protectedSettings') ? desiredStateConfigurationSettings.protectedSettings : null
   }
 }
 
@@ -528,13 +528,13 @@ module virtualMachine_customScriptExtension '.bicep/nested_extension.bicep' = if
     typeHandlerVersion: '1.9'
     autoUpgradeMinorVersion: true
     settings: {
-      fileUris: [for fileData in windowsScriptExtensionFileData: contains(fileData, 'storageAccountId') ? '${fileData.uri}?${listAccountSas(fileData.storageAccountId, '2019-04-01', accountSasProperties).accountSasToken}' : '${fileData.uri}']
+      fileUris: [for fileData in windowsScriptExtensionFileData: contains(fileData, 'storageAccountId') ? '${fileData.uri}?${listAccountSas(fileData.storageAccountId, '2019-04-01', accountSasProperties).accountSasToken}' : fileData.uri]
     }
     protectedSettings: {
       commandToExecute: windowsScriptExtensionCommandToExecute
-      storageAccountName: ((!empty(cseStorageAccountName)) ? cseStorageAccountName : json('null'))
-      storageAccountKey: ((!empty(cseStorageAccountKey)) ? cseStorageAccountKey : json('null'))
-      managedIdentity: ((!empty(cseManagedIdentity)) ? cseManagedIdentity : json('null'))
+      storageAccountName: !empty(cseStorageAccountName) ? cseStorageAccountName : null
+      storageAccountKey: !empty(cseStorageAccountKey) ? cseStorageAccountKey : null
+      managedIdentity: !empty(cseManagedIdentity) ? cseManagedIdentity : null
     }
   }
 }
@@ -564,7 +564,7 @@ resource virtualMachine_lock 'Microsoft.Authorization/locks@2017-04-01' = if (lo
   name: '${virtualMachine.name}-${lock}-lock'
   properties: {
     level: lock
-    notes: (lock == 'CanNotDelete') ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
+    notes: lock == 'CanNotDelete' ? 'Cannot delete resource or child resources.' : 'Cannot modify the resource or child resources.'
   }
   scope: virtualMachine
 }