AZ-104 Practice Question 22: Policy Remediation Task
Microsoft Azure Administrator Associate (AZ-104) · Test 3 · question 2 of 10
Using a Bicep pipeline (not the portal), you assign a built-in policy with a deployIfNotExists effect at subscription scope. The policy configures diagnostic settings on storage accounts.
Two weeks later:
- Storage accounts created since the assignment have the diagnostic setting. - The 300 accounts that existed beforehand are still reported as non-compliant. - A remediation task you started fails with an authorization error.
What must you do?
Show answer and explanation
Answer:
Both halves of the symptom have the same documented cause. deployIfNotExists acts on create and update requests, so resources that already existed "can be put into a compliant state through Remediation ... accomplished through remediation tasks that deploy the deployIfNotExists template ... on your existing resources." And when Azure Policy runs that deployment it "does so using a managed identity associated with the policy assignment," which "needs to be assigned the minimum Azure role-based access control (Azure RBAC) role required to remediate resources." The portal grants those roles automatically; a pipeline does not: "if the assignment is created through an Azure software development kit (SDK) ... the assignment's managed identity must be manually granted access through the addition of roles, or else the remediation deployment will fail."
Option B changes what the policy does. deny blocks non-compliant *new* requests; it never configures anything, so the 300 existing accounts would stay exactly as they are, and future deployments would start failing outright.
Option C misreads evaluation. A compliance scan updates the compliance *report*; it does not deploy anything. Existing resources only change when a remediation task runs.
Option D changes the scope, not the behaviour. The same deployIfNotExists semantics apply at any scope, and the managed identity still needs its roles. Widening the scope just adds more non-compliant resources to the report.
Reference: Remediate non-compliant resources with Azure Policy