Question

Difficulty: MediumAzure Policy

An administrator deploys a new Azure Policy definition with a "Deny" effect to a subscription. The policy is configured to prevent the creation of storage accounts that do not have secure transfer enabled. At the time of assignment, the subscription already contains three storage accounts that have secure transfer disabled. What is the effect of this policy assignment on the resources in the subscription?

  1. A
    The three existing storage accounts will be automatically updated to enable secure transfer, and new non-compliant deployments will be blocked.
  2. B
    Users with the Owner role will have their permissions revoked for the three existing storage accounts, preventing them from modifying those resources.
  3. New deployment attempts for storage accounts without secure transfer enabled will be blocked, while the three existing non-compliant storage accounts will remain active but marked as non-compliant in evaluation reports.Answer
  4. D
    The three existing storage accounts will be automatically deleted to enforce compliance, and new non-compliant deployments will be blocked.

Answer

New deployment attempts for storage accounts without secure transfer enabled will be blocked, while the three existing non-compliant storage accounts will remain active but marked as non-compliant in evaluation reports.
When a policy with a Deny effect is assigned, it prevents any new deployment or modification requests that do not comply with the policy rules. However, it does not retroactively delete or modify existing resources that were deployed before the policy was put in place. Instead, those pre-existing resources continue to run but are flagged as non-compliant in the Azure Policy dashboard so that administrators are aware of them.

Step-by-Step Solution

1
Analyze the policy effect and the target resources.
The policy uses a Deny effect to prevent creation/modification of non-compliant resources (storage accounts without secure transfer).
Understanding the policy's primary behavior helps determine how new deployment requests will be handled.
2
Evaluate the impact on existing resources.
Existing resources are evaluated against the policy but are not retroactively modified, deleted, or blocked from executing their normal operations.
This differentiates the evaluation behavior from creation enforcement.
3
Determine the status of existing non-compliant resources.
The existing resources will remain active but will show up as non-compliant in the compliance portal.
This aligns with the design of Azure Policy to provide compliance visibility without disrupting running services.

Key Concept

Azure Policy enforcement behavior and compliance evaluation of existing resources
Rate this question