this is on azure-native (nextgen) btw. I noticed in good ol' azure it was easy to just make a reference to the name I specified in the higher level configuration - but having to supply the fully qualified ID is just beyond my understanding of how these things are supposed to work.