AZ-500 Question 187
Single answerYou have created a custom Azure Policy that uses the 'modify' effect to ensure that all resources in your subscription have a 'Department' tag set to 'Finance' if no value is provided. After assigning this policy at the subscription scope, new resources are correctly tagged, but existing resources remain untagged. What should you do to ensure that existing resources are also updated with the 'Department' tag?
- A
Reassign the policy using the 'append' effect to retroactively tag existing resources
- B
Create and run a remediation task for the existing policy assignment
- C
Change the policy effect to 'AuditIfNotExists' to automatically enforce tags on existing resources
- D
Reassign the policy at the management group level to ensure existing resources are updated
Show answer and explanation
Correct answer: B
Explanation
Azure Policy definitions with 'modify' (or 'append') effects apply changes only on resource creation or update. To update existing resources that are already deployed, you must explicitly run a remediation task for the policy assignment. Refer to Microsoft documentation on Policy Remediation Tasks (https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources) for detailed steps on applying policy changes to existing noncompliant resources.
- A. Incorrect.
Incorrect. The 'append' effect can add tags on resource creation, but it still won't retroactively apply tags to resources that already exist. Reassigning with 'append' will have the same limitation for existing resources.
- B. Correct.
Correct. For a 'modify' (or 'append') policy to affect existing noncompliant resources, you must create and run a remediation task. This retroactively applies the policy's changes to existing resources.
- C. Incorrect.
Incorrect. 'AuditIfNotExists' marks resources as noncompliant if they lack required tags but does not automatically apply or modify tags on those resources. It only flags existing resources without updating them.
- D. Incorrect.
Incorrect. Moving the assignment to a higher scope (such as a management group) does not retroactively apply changes to existing resources. A remediation task remains necessary for enforcing policy on existing resources.