A governance team wants the policy to block creation or update of App Service resources whenever HTTPS-only is not enabled. Which Azure Policy effect should the definition use?
Show answer and explanation
Answer: C
The Deny effect blocks any create or update request that would produce a non-compliant resource, so noncompliant configurations never reach the subscription. Audit only records violations after the fact, Disabled turns the definition off, and Append adds properties to a request without refusing one that sets the wrong value. Deny is the enforcing choice here.
Why the other options are wrong
- A. Audit flags non-compliant resources in the compliance view but still permits creating them, so the rule is advisory only.
- B. A disabled definition evaluates nothing, so it would allow App Service apps without HTTPS-only to be created.
- D. Append can insert missing fields into a request, but it does not reject a request that explicitly turns HTTPS-only off.