Microsoft Certified: Azure Administrator AssociateManage Azure identities and governanceEasy
A client has an Azure subscription and several resource groups. They want to ensure that all resources deployed into a specific resource group named 'ProdAppRG' are automatically tagged with 'Environment: Production' and 'CostCenter: 12345'. This tagging should be mandatory and applied without manual intervention. Which Azure feature should the client use?
- AAzure Blueprints
- BAzure Resource Locks
- CAzure Management Groups
- DAzure Policy
Show answer & explanationAnswer & explanation
Correct answer: D. Azure Policy
Azure Policy allows you to define and enforce rules for your Azure resources. A 'Modify' policy effect can be used to automatically add or update tags on resources during deployment, ensuring compliance with tagging standards without manual intervention.
Why the other options are wrong
- A. Azure Blueprints define a repeatable set of Azure resources and policies, but for ongoing enforcement of tagging on new or existing resources within a specific scope, Azure Policy is the direct tool.
- B. Azure Resource Locks prevent accidental deletion or modification of resources, but they do not automatically apply tags.
- C. Azure Management Groups help organize subscriptions but do not directly enforce tagging on resources within a resource group.
Azure Policy for Tagging
Azure Policy enables the enforcement of organizational standards and assessment of compliance for Azure resources, including the automatic application or modification of tags.
- Can audit for missing tags or enforce specific tag values.
- The 'Modify' effect can automatically add or replace tags.
- Policies can be assigned at various scopes, including resource groups.
Memory trick: Policy dictates the tags, ensuring everything is labeled correctly.