Hotspot Question Your company has an Azure subscription. The company requires that all resource group in the subscription have a tag named organization set to a value of Contoso. You need to implement

Question

Exhibit

Answer Area

• Resource Type"Microsoft.Resources/subscriptions/resourceGroups"
  "Microsoft.Resources/deployments""Microsoft.Resources/subscriptions""Microsoft.Resources/subscriptions/resourceGroups"
• effect"Deny"
  "Append""Deny""DeployIfNotExists"

Explanation

This question tests your ability to construct an Azure Policy definition JSON that enforces a specific tag and value on all resource groups in a subscription.

Approach. The policy definition should use the 'policyRule' with an 'if' condition that checks the 'type' equals 'Microsoft.Resources/subscriptions/resourceGroups' and uses the 'notEquals' or 'exists:false' condition to check if the 'organization' tag is missing or not set to 'Contoso'. The 'then' effect should be set to 'deny' to prevent creation/modification of resource groups that do not have the tag 'organization' set to 'Contoso'. The correct structure includes: (1) 'field': 'tags[organization]' in the condition, (2) 'notEquals': 'Contoso' or 'exists': 'false' as the operator, and (3) 'effect': 'deny' in the 'then' block. The policy mode should be set to 'All' to include resource groups and subscriptions, as the default 'Indexed' mode only applies to resource types that support tags and location but does not include resource groups in all scenarios.

Concept tested. Azure Policy definition structure for enforcing tags on resource groups, including the correct use of policy mode ('All'), the 'field' condition referencing 'tags[organization]', the appropriate logical operator ('notEquals' with value 'Contoso'), and the 'deny' effect to enforce compliance.

Reference. https://learn.microsoft.com/en-us/azure/governance/policy/concepts/definition-structure

No community discussion yet for this question.