I'm getting an error when I try to deploy an AKS cluster using an ARM template, if the vnetSubnetId in the agentPoolProfiles property is a reference. I've used this exact template before without problems (on October 4th) but now I'm seeing an error with multiple different clusters, and when I do it either through a VSTS pipeline, or manually using PowerShell.

The property is set up like this:

"agentPoolProfiles": [
  {
    "name": "agentpool",
    "count": "[parameters('agentCount')]",
    "vmSize": "[parameters('agentVMSize')]",
    "osType": "Linux",
    "dnsPrefix": "[variables('agentsEndpointDNSNamePrefix')]",
    "osDiskSizeGB": "[parameters('agentOsDiskSizeGB')]",
    "vnetSubnetID": "[reference(concat('Microsoft.Network/virtualNetworks/', variables('vnetName'))).subnets[0].id]"
  }
]

The variable 'vnetName' is based on an input parameter I use for the cluster name, and the vnet itself 100% exists, and is deployed as part of the same template.

If I try to deploy a new cluster I get the following error:

Message: {
  "code": "InvalidParameter",
  "message": "The value of parameter agentPoolProfile.vnetSubnetID is invalid.",
  "target": "agentPoolProfile.vnetSubnetID"
 }

If I try to re-deploy a cluster, with no changes to the template or input parameters since it last worked, I get the following error:

Message: {
  "code": "PropertyChangeNotAllowed",
  "message": "Changing property 'agentPoolProfile.vnetSubnetID' is not allowed.",
  "target": "agentPoolProfile.vnetSubnetID"
 }

Has something changed that means I can no longer get the vnet ID at runtime? Does it need to be passed in as a parameter now? If something has changed, is there anywhere I can find out the details?

Edit: Just to clarify, for re-deploying a cluster, I have checked and there are no new subnets, and I'm seeing the same behavior on 3 different clusters with different VNets.

Switching from reference() to resourceId() did fix the problem so has been marked as the answer, but I'm still no clearer on why reference() stopped working, will update that here as well if I figure it out.