BenchMark Quizzes by MDFT Pro

Complete Azure Policy For Resource Group Tag Enforcement

MDFT Pro, a well-known training agency, needs to implement governance policies across their Azure environment to ensure proper resource organization and cost tracking for their educational services. Mark, the Governance Policy Designer, is creating a custom Azure Policy to enforce tagging standards for resource groups.

The company requires that every resource group has an “organization” tag set to “MDFT Pro” to enable accurate cost allocation and compliance reporting for their training programs. Claire, the Governance Policy Coordinator, needs the policy to allow resource groups to be created through the Azure portal while ensuring that compliance reports accurately reflect which resource groups are missing the required tag.

{
  "mode": "all",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "tags['organization']",
          "notEquals": "MDFT Pro"
        },
        {
          "field": "type",
          "equals": "Microsoft.Resources/resourceGroups"
        }
      ]
    },
    "then": {
      "effect": "__________"
    }
  }
}

What effect should Mark specify to meet all the requirements: allow portal creation, ensure compliance reporting accuracy, and enforce the organization tag standard?

Choose the correct answer from the options below.

Explanations for each answer:

Append is incorrect. The Append effect adds properties to resources during creation, but it cannot modify existing tags or enforce specific tag values. This effect is used to add new properties, not to validate compliance with tag requirements.
Deny is incorrect. The Deny effect prevents resource creation or modification, but would block resource group creation entirely if the tag is missing. This doesn't allow creation from the portal or provide accurate compliance reporting.
Modify is incorrect. The Modify effect can alter resource properties during creation or updates, but it's more complex and typically used for adding or changing properties rather than simple compliance reporting.
Audit is correct. The Audit effect allows resources to be created but marks them as non-compliant in compliance reports when they don't meet policy requirements. This enables portal creation while providing accurate compliance reporting for missing organization tags.

Learn More About Azure Policy Effects:

Azure Policy Effects

Exam Preparation Quiz

Complete Azure Policy For Resource Group Tag Enforcement