Microsoft Azure Fundamentals (AZ-900)Describe Azure management and governanceMedium
A global enterprise has strict regulatory requirements to ensure that all data stored in Azure remains within a specific geographical region. They want to prevent users from accidentally or intentionally deploying resources outside of approved regions. Which Azure governance feature should they implement?
- AAzure Management Groups
- BAzure Resource Locks
- CAzure Blueprints
- DAzure Policy
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Policy
Azure Policy allows you to define and enforce rules over your Azure resources. A common use case is to restrict resource deployment to specific Azure regions, which directly addresses the enterprise's regulatory requirement and prevents deployments outside approved geographies.
Why the other options are wrong
- A. Azure Management Groups provide a hierarchy for organizing subscriptions, but they do not enforce resource deployment rules directly; Policy is used for that purpose.
- B. Azure Resource Locks prevent accidental deletion or modification of resources, but they do not prevent creation in unapproved regions.
- C. Azure Blueprints define a repeatable set of Azure resources, policies, and roles, but Policy is the specific component used for enforcing regional restrictions.
Azure Policy
A service in Azure that helps enforce organizational standards and assess compliance at scale. It can enforce rules like restricting resource deployment to specific regions.
- Enforces rules and effects over resources.
- Evaluates compliance of existing and new resources.
- Can restrict resource locations, types, and configurations.
Memory trick: Govern with 'P'olicy, 'B'lueprints, 'M'anagement, and 'L'ocks.