An administrator deploys a new Azure Policy definition with a "Deny" effect to a subscription. The policy is configured to prevent the creation of storage accounts that do not have secure transfer enabled. At the time of assignment, the subscription already contains three storage accounts that have secure transfer disabled. What is the effect of this policy assignment on the resources in the subscription?
- AThe three existing storage accounts will be automatically updated to enable secure transfer, and new non-compliant deployments will be blocked.
- BUsers with the Owner role will have their permissions revoked for the three existing storage accounts, preventing them from modifying those resources.
- New deployment attempts for storage accounts without secure transfer enabled will be blocked, while the three existing non-compliant storage accounts will remain active but marked as non-compliant in evaluation reports.Answer
- DThe three existing storage accounts will be automatically deleted to enforce compliance, and new non-compliant deployments will be blocked.
Answer
New deployment attempts for storage accounts without secure transfer enabled will be blocked, while the three existing non-compliant storage accounts will remain active but marked as non-compliant in evaluation reports.
When a policy with a Deny effect is assigned, it prevents any new deployment or modification requests that do not comply with the policy rules. However, it does not retroactively delete or modify existing resources that were deployed before the policy was put in place. Instead, those pre-existing resources continue to run but are flagged as non-compliant in the Azure Policy dashboard so that administrators are aware of them.
Step-by-Step Solution
Key Concept
Azure Policy enforcement behavior and compliance evaluation of existing resources