A platform team wants to stop engineers from creating oversized virtual machines in the production subscriptions, no matter which deployment tool they use. Which mechanism should the team apply?
Show answer and explanation
Answer: C
An Azure Policy assignment that limits the allowed VM SKUs is evaluated by Azure Resource Manager on every create or update request, so it applies whichever tool, portal, CLI, or pipeline submits the deployment. Assigning it at the production management group or subscription scope lets it be inherited by all child resources. Enforcement happens at the platform level, which is what the requirement asks for.
Why the other options are wrong
- A. A Bicep parameter restriction only applies when that specific template is deployed. Someone can still create a large VM through the portal or a different template, so the control is not enforced across the environment.
- B. Budgets report and alert on spending but never block a deployment. An oversized VM would still be created even after the budget threshold was crossed, so the control does not limit sizes.
- D. Resource locks protect existing resources from deletion or modification. They do not restrict which VM sizes can be created, and new oversized VMs would still deploy freely.
Exam tip. For enforcing allowed resource configurations across subscriptions, choose Azure Policy.