Hotspot Question You need to design an Azure policy that will implement the following functionality: - For new resources, assign tags and values that match the tags and values of the resource group…

Question

Exhibits

Answer Area

• Azure Policy effect to use:
  AppendAuditMutateModify
• Microsoft Entra object and role-based access control (RBAC) role to use for the remediation tasks:
  A managed identity with the Contributor roleA managed identity with the User Access Administrator roleA service principal with the Contributor roleA service principal with the User Access Administrator role

Explanation

This question tests knowledge of Azure Policy effects and the correct managed identity role required to implement tag inheritance with automated remediation using the principle of least privilege.

Approach. For the Policy Effect, you should use 'Modify' - this effect is used to add, update, or delete tags on resources during creation/update (for new resources) and supports remediation tasks for existing non-compliant resources. The 'Modify' effect evaluates existing resources for compliance and allows auto-generated remediation tasks to fix non-compliant resources by applying the missing tags. For the Managed Identity Role Assignment, you should assign the 'Contributor' role - however, following the principle of least privilege, the minimum required role is 'Tag Contributor', which grants only the permissions needed to write tags on resources without granting broader permissions. The Tag Contributor built-in role allows the managed identity used by the remediation task to add or update tags on existing resources without granting unnecessary access. The policy initiative should use the built-in 'Inherit a tag from the resource group if missing' policy definition, which uses the Modify effect and requires a managed identity with Tag Contributor permissions to perform remediation.

Concept tested. Azure Policy effects (specifically the 'Modify' effect for tag management and remediation), managed identity role assignments for remediation tasks, and the principle of least privilege when assigning roles to policy-managed identities.

Reference. https://learn.microsoft.com/en-us/azure/governance/policy/concepts/effects#modify

No community discussion yet for this question.