AZ-500 Question 189
Single answerYou are a security engineer at Contoso, managing multiple Azure subscriptions under a single Azure Active Directory tenant. You created and assigned an Azure Policy at the Management Group level that requires all newly created resource groups to include a 'CostCenter' tag. However, you observe that some subscriptions are still allowing the creation of resource groups without the required tag. You want to ensure consistent enforcement of the policy across all subscriptions. What should you do?
- A
Reassign the policy at each subscription level individually for all subscriptions.
- B
Modify the existing policy assignment to use the default enforcement mode and create a remediation task for non-compliant resources.
- C
Create a new initiative that includes the same tagging policy without altering the existing policy assignments.
- D
Move non-compliant resource groups to a different management group that has the same policy in place.
Show answer and explanation
Correct answer: B
Explanation
Azure Policy can enforce governance requirements across subscriptions by assigning policies or initiatives at the management group level. To correct and prevent non-compliance, you must ensure the policy is set to 'deny' new non-compliant resources (the default enforcement mode) and run a remediation task to fix existing resources. Microsoft documentation on Azure Policy (https://learn.microsoft.com/azure/governance/policy/overview) recommends running remediation tasks to bring resources into compliance when first applying or updating a policy.
- A. Incorrect.
Option 1 is incorrect. Reassigning the same policy individually at the subscription level is possible but does not guarantee you will remediate existing non-compliant resources or leverage centralized management from the original management group assignment.
- B. Correct.
Option 2 is correct. By modifying the policy assignment to enforce the required tag at the management group level and creating a remediation task, you ensure existing resource groups become compliant and future deployments are denied if they do not have the required tag. ‘Default’ enforcement mode denies non-compliant resource creations, and remediation tasks help bring existing resources into compliance.
- C. Incorrect.
Option 3 is incorrect. While initiatives can group multiple policies for easier management, creating a new initiative alone doesn’t solve the underlying issue of existing non-compliant resources or the insufficient enforcement settings. You would still need to enforce and remediate properly.
- D. Incorrect.
Option 4 is incorrect. Moving resource groups to another management group does not address the core enforcement problem. If the policy is not properly enforced or remediated, non-compliant resources can remain unchanged.