AZ-104 Question 36
Single answerYou are an Azure Administrator at Contoso. Your team has created a custom Azure Policy definition that restricts certain VM sizes. Multiple subscriptions within your organization need this same restriction, and stakeholders want to track compliance across all subscriptions using a single report. Which is the best way to implement and manage this requirement?
- A
Assign the custom policy definition separately in each subscription to enforce the restriction
- B
Include the custom policy in an initiative and assign it at the management group level
- C
Use Policy exemptions for any subscriptions that need the restriction
- D
Apply the policy definition at the subscription scope, then rely on Resource Locks for compliance monitoring
Show answer and explanation
Correct answer: B
Explanation
Using an initiative at the management group level allows you to group your policy definitions, apply them across multiple subscriptions in one unified assignment, and consolidate compliance reporting for those subscriptions.
- A. Incorrect.
Assigning the policy definition individually to each subscription works, but it requires more manual effort and separate compliance tracking in each subscription.
- B. Correct.
By creating an initiative that includes the custom policy and assigning it at the management group level, you can enforce the policy across multiple subscriptions and see combined compliance results.
- C. Incorrect.
Policy exemptions are used to exclude specific resources or scopes from a policy assignment, not to replicate a policy across multiple subscriptions.
- D. Incorrect.
Resource Locks prevent changes to certain resources but do not provide the granular compliance enforcement and reporting capabilities of an Azure Policy assignment.