Can't create Data Collection Rule association with bicep

The error InvalidAssociation with message Rule Id '...' does not exist when deploying a Data Collection Rule Association (DCRA) via Bicep almost always indicates that the dataCollectionRuleId being passed to the association resource is not a valid, existing Data Collection Rule resource ID in that subscription/scope at deployment time.

From the available information, the key points to validate in the failing subscription are:

1. Confirm the DCR actually exists in that subscription and region
   Use the DCR’s full resource ID and verify it directly before creating the association:
   • The DCR must be a Microsoft.Insights/dataCollectionRules resource.
   • The ID must be of the form:
     /subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}.
   • Ensure the subscription ID and resource group in the ID match the failing subscription, not a different one where the template previously worked.
2. Ensure the association references the DCR by full resource ID, not by name
   In Bicep, the association must use dataCollectionRuleId with the full resource ID, not just the name. For example (2021-04-01 or 2024-03-11 API):

      resource dcr 'Microsoft.Insights/dataCollectionRules@2024-03-11' existing = {
        name: 'my-dcr-name'
      }
      
      resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2024-03-11' = {
        scope: someResource
        name: 'myAssociationName'
        properties: {
          dataCollectionRuleId: dcr.id
          // dataCollectionEndpointId: '...'  // if applicable
          description: 'Association to existing DCR'
        }
      }
   

   The dataCollectionRuleId property is required in all documented API versions and must be a valid resource ID.
3. Check the Bicep scope for the association
   The Microsoft.Insights/dataCollectionRuleAssociations resource is scoped to the resource being monitored, not to the DCR. In Bicep, it must be declared with the correct scope:

      resource target 'Microsoft.KeyVault/vaults@2023-02-01' existing = {
        name: 'my-kv'
      }
      
      resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2024-03-11' = {
        scope: target
        name: 'metrics-association'
        properties: {
          dataCollectionRuleId: dcr.id
          description: 'Associate DCR to Key Vault'
        }
      }
   

   If the scope is wrong (for example, left at the resource group or subscription level when the association must be on a specific resource), the platform can report that the rule does not exist for that association.
4. Verify the API version and properties used
   For Microsoft.Insights/dataCollectionRuleAssociations, the supported Bicep resource format includes:

      resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2024-03-11' = {
        scope: resourceSymbolicName or scope
        name: 'string'
        properties: {
          dataCollectionEndpointId: 'string'
          dataCollectionRuleId: 'string'
          description: 'string'
        }
      }
   

   or for 2021-04-01:

      resource association 'Microsoft.Insights/dataCollectionRuleAssociations@2021-04-01' = {
        scope: resourceSymbolicName or scope
        name: 'string'
        properties: {
          dataCollectionEndpointId: 'string'
          dataCollectionRuleId: 'string'
          description: 'string'
        }
      }
   

   Ensure the template in the failing subscription uses one of these supported API versions and includes dataCollectionRuleId exactly as shown.
5. Cross-check with CLI or PowerShell in the failing subscription
   To isolate whether the issue is with Bicep or with the resource itself, try creating the association via CLI or PowerShell using the same IDs:
   • Azure CLI:

          az monitor data-collection rule association create \
            --name <association-name> \
            --rule-id "/subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}" \
            --resource "/subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/{ResourceProvider}/{ResourceType}/{ResourceName}"
     

   • PowerShell:

          New-AzDataCollectionRuleAssociation \
            -AssociationName <String> \
            -ResourceUri "/subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/{ResourceProvider}/{ResourceType}/{ResourceName}" \
            -DataCollectionRuleId "/subscriptions/{subscriptionId}/resourceGroups/{rgName}/providers/Microsoft.Insights/dataCollectionRules/{dcrName}"
     

   If these commands fail with the same InvalidAssociation error, the DCR ID or its existence in that subscription is the root cause. If they succeed, compare the exact IDs used in the commands with what the Bicep module outputs.
6. Subscription-specific differences
   Since the same Bicep works in other subscriptions, focus on differences in the failing subscription:
   • DCR name or resource group is different from what the module expects.
   • The DCR is in a different subscription or resource group than the association’s deployment context.
   • The Bicep existing reference or parameter used to build dataCollectionRuleId is pointing to a different provider or missing Microsoft.Insights in the path.

By aligning the Bicep association resource with the documented dataCollectionRuleAssociations schema, ensuring the scope is the monitored resource, and verifying the full DCR resource ID via CLI or PowerShell in the failing subscription, the InvalidAssociation error can be resolved.

References:

• Metrics export using data collection rules (Preview)
• Microsoft.Insights dataCollectionRuleAssociations 2024-03-11 (deployment-language-bicep)
• Microsoft.Insights dataCollectionRuleAssociations 2021-04-01 (deployment-language-bicep)
• Create data collection rules (DCRs) using JSON
• az monitor data-collection rule association