An administrator wants to assign a custom rule that permits only a specific list of virtual machine sizes. What must exist before that assignment can be created?
Show answer and explanation
Answer: A
A policy definition is the JSON document that contains the condition and the effect. An assignment is only a reference to a definition plus a scope and optional parameters and exclusions, so the definition must already exist in the tenant before it can be assigned. Built-in definitions are supplied by Microsoft; a custom one is created at a management group or subscription and can then be assigned at that scope or below. An initiative is a wrapper around definitions and is optional.
Why the other options are wrong
- B. An initiative, also called a policy set, groups several definitions so they can be assigned and reported together. It is a convenience layer and is not required to assign a single definition.
- C. A management group is a scope at which an assignment can be made. It is not the rule itself, and an assignment can equally be made at a subscription or resource group.
- D. A resource lock prevents deletion or modification of resources. It has no relationship to policy definitions or assignments.
Exam tip. Definition then assignment; initiative only if you want to bundle definitions.