Vortex Media is designing a governance and compliance strategy for its Azure environment. The resources are organized under a management group hierarchy. The company has the following key compliance requirements:
1. All virtual machines deployed in the production subscriptions must have the Azure Monitor agent installed and configured automatically during deployment.
2. In the development subscriptions, if a virtual machine is deployed without the Azure Monitor agent, it should be allowed to deploy but must be flagged as non-compliant for auditing purposes.
3. No resource groups in any subscription should be created without a 'CostCenter' tag. If the tag is missing, the deployment must be blocked. However, an exception must be made for the 'Sandbox-Subscriptions' management group, where tags are not enforced.
You need to recommend the Azure Policy design to meet these requirements with minimal administrative overhead. Which of the following recommendations should you include in the design? (Select TWO options.)
- Assign an Azure Policy with the DeployIfNotExists effect at the production management group scope to automatically deploy the Azure Monitor agent on virtual machines.Cevap
- Assign an Azure Policy with the Deny effect to enforce the 'CostCenter' tag on resource groups at the root management group scope, and configure the 'Sandbox-Subscriptions' management group as an excluded scope (notScopes) in the policy assignment.Cevap
- CAssign an Azure Policy with the Deny effect at the production management group scope to block the deployment of virtual machines that do not have the Azure Monitor agent.
- DAssign an Azure Policy with the Modify effect at the development subscriptions scope to block virtual machines that do not have the Azure Monitor agent.
- ECreate individual Policy Exemptions for each resource group created in the Sandbox-Subscriptions management group to bypass the tag enforcement policy.