A logistics company wants every resource that supports diagnostic logs to send them to one central Log Analytics workspace. Existing resources that lack the setting, and any new ones, must be corrected without manual steps. Which Azure Policy effect should be used?
Show answer and explanation
Answer: B
DeployIfNotExists checks whether a related configuration exists on a resource and, when it is missing, deploys it, including through remediation tasks for existing resources. Here the missing diagnostic setting is created automatically, so logs reach the central workspace without anyone configuring each resource. Audit only reports and changes nothing. Disabled turns the rule off entirely. Weekly manual remediation leaves gaps until the next cycle.
Why the other options are wrong
- A. Audit flags non-compliant resources in the compliance report but changes nothing, so the diagnostic settings would stay missing until someone fixed them.
- C. Disabled switches the policy off entirely, so it neither reports nor corrects missing diagnostic settings on any resource.
- D. Weekly manual remediation leaves a gap until the next cycle, and resources created in between go unconfigured in the meantime.