diff --git a/eng/common/TestResources/SubConfig-Helpers.ps1 b/eng/common/TestResources/SubConfig-Helpers.ps1
index 8df6440fe..ab2344283 100644
--- a/eng/common/TestResources/SubConfig-Helpers.ps1
+++ b/eng/common/TestResources/SubConfig-Helpers.ps1
@@ -196,17 +196,26 @@ function UpdateSubscriptionConfigurationWithFiles([object]$baseSubConfig, [strin
 # Helper function for processing stringified json sub configs from pipeline parameter data
 function BuildAndSetSubscriptionConfig([string]$baseSubConfigJson, [string]$additionalSubConfigsJson, [string]$subConfigFilesJson) {
   $finalConfig = @{}
-  if ($baseSubConfigJson) {
+
+  if ($baseSubConfigJson -and $baseSubConfigJson -ne '""') {
+    # When variable groups are not added to the pipeline, secret references like
+    # $(<my secret>) are passed as a string literal instead of being replaced by the keyvault secret value
+    if ($baseSubConfigJson -notlike '{*') {
+      throw "Expected a json dictionary object but found '$baseSubConfigJson'. This probably means a subscription config secret was not downloaded. The pipeline is likely missing a variable group."
+    }
     $baseSubConfig = $baseSubConfigJson | ConvertFrom-Json -AsHashtable
 
     Write-Host "Setting base sub config"
     $finalConfig = SetSubscriptionConfiguration $baseSubConfig
   }
 
-  if ($additionalSubConfigsJson) {
+  if ($additionalSubConfigsJson -and $additionalSubConfigsJson -ne '""') {
     $subConfigs = $additionalSubConfigsJson | ConvertFrom-Json -AsHashtable
 
     foreach ($subConfig in $subConfigs) {
+      if ($subConfig -isnot [hashtable]) {
+        throw "Expected a json dictionary object but found '$subConfig'. This probably means a subscription config secret was not downloaded. The pipeline is likely missing a variable group."
+      }
       Write-Host "Merging sub config from list"
       $finalConfig = UpdateSubscriptionConfiguration $finalConfig $subConfig
     }
diff --git a/eng/common/TestResources/deploy-test-resources.yml b/eng/common/TestResources/deploy-test-resources.yml
index d5fd1d353..840acfd9e 100644
--- a/eng/common/TestResources/deploy-test-resources.yml
+++ b/eng/common/TestResources/deploy-test-resources.yml
@@ -43,7 +43,7 @@ steps:
 
   - ${{ if eq('true', parameters.UseFederatedAuth) }}:
     - task: AzurePowerShell@5
-      displayName: Deploy test resources
+      displayName: 🚀 Deploy test resources
       env:
         TEMP: $(Agent.TempDirectory)
         PoolSubnet: $(PoolSubnet)
@@ -96,7 +96,7 @@ steps:
           -ServicePrincipalAuth `
           -Force `
           -Verbose | Out-Null
-      displayName: Deploy test resources
+      displayName: 🚀 Deploy test resources
       env:
         TEMP: $(Agent.TempDirectory)
         PoolSubnet: $(PoolSubnet)