An organization wants developers to be unable to deploy Azure resources unless those resources include a “ProjectCode” tag. Which Azure Policy effect fits?
Show answer and explanation
Answer: B
The requirement is that resources without the tag must not exist, and Deny is the effect that enforces exactly that: Azure Resource Manager rejects the create-or-update request and the deployment fails until the requester supplies the ProjectCode tag. Audit merely observes and reports noncompliance after the fact, while Modify and Append are approaches that add tags rather than prevent tagless resources from ever existing.
Why the other options are wrong
- A. Audit logs the violation without stopping it, so tagless resources still get deployed — a weaker standard than “cannot deploy without.”
- C. Modify can inject a default tag during creation, which means the requirement becomes satisfied without the developer acting at all — a different rule from rejecting untagged deployments.
- D. Append adds supplementary properties but doesn't guarantee the tag requirement was met at deployment time; it assists rather than enforces in the way the question describes.