AZ-104 Practice Question 53: Policy Require Tag Deny
Microsoft Azure Administrator Associate (AZ-104) · Test 6 · question 3 of 10
Finance needs every resource to carry a CostCenter tag so that spending can be charged back. The cloud team wants any attempt to create a resource in a subscription without that tag to be rejected at deployment time, for every user including subscription owners.
What should the team do?
Show answer and explanation
Answer:
Azure Policy evaluates a resource during creation or update, and the Deny effect stops the request before it reaches the resource provider when the resource does not meet the rule; the request is returned as a 403 (Forbidden). The built-in Require a tag on resources definition checks for a named tag and uses the Deny effect, so assigned at the subscription it rejects untagged deployments. Policy is evaluated separately from RBAC, so subscription owners are covered too.
Option A only reports. Audit lets the deployment succeed and marks the resource as non-compliant, so untagged resources would still be created and would have to be found and fixed afterwards.
Option C protects resources from being deleted or modified. It says nothing about which tags a new resource carries, and it would not stop an untagged resource from being created.
Option D cannot work. Azure RBAC decides whether an identity may perform an action; it does not evaluate the content of a request such as the tags on the resource being created, so a role cannot be conditional on a missing tag in this way.
Reference: Azure Policy definitions deny effect