Azure Policy effect for Department tag on new resource groups?
You have an Azure subscription. You need to implement a policy to ensure that all new resource groups include a value for a tag named Department. The solution must ensure that if a value is NOT entered for the Department tag, a resource group is created. Which effect should you use?
Community Insight
The question tests Azure Policy effects for tag enforcement at resource-group creation, and the trap is selecting deny because it sounds strict but actually blocks the resource group instead of adding the Department tag.
Azure Policy tag enforcement for new resource groups depends on choosing an effect that adds a missing Department value without stopping creation. This page establishes that the modify effect (B) is correct and explains why deny, manual, and deployIfNotExists do not meet the requirement.
A common mistake is choosing deny to force the Department tag, but deny prevents resource group creation when the tag is absent, directly contradicting the requirement that the resource group still be created.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
The modify effect is designed to add, update, or alter properties and tags on a resource during its creation or update. For a new resource group with no Department value, the policy can append the tag with a default value and let the resource group deployment proceed. Azure's built-in "Add a tag to resource groups" policy uses the modify effect for this exact tag-enforcement scenario. Therefore B satisfies both parts of the requirement: the Department tag is present and the resource group is still created when no value was entered.Why the Other Options Are Wrong
Deny would reject the resource group request when Department is absent, which conflicts with the requirement that the group still be created. The manual effect only records non-compliance for later human action; it does not inject a Department value during creation. DeployIfNotExists is aimed at deploying a template or related resources when a condition is not met after evaluation, not at mutating the incoming resource group's tags. So A, C, and D do not deliver the automatic tag addition while allowing creation.Community Comment Notes
AllanHouston's comment aligns with the documented behavior: they note that modify is intended to "add, update, or alter properties and tags" during creation or update. In this scenario that means an empty Department tag can be filled automatically while the resource group deployment still succeeds. The comment's choice of B matches the creation-allowed requirement, and no commenter argues that deny, manual, or deployIfNotExists provides the needed tag insertion.Official Reference
Exam Strategy
When the requirement says the resource must still be created, immediately eliminate deny. Then ask whether the policy should mutate the resource's properties or tags (modify) or deploy another template after evaluation (deployIfNotExists).
Frequently Asked Questions
Why is the deny effect wrong when I want the Department tag enforced?
Deny blocks creation when Department is missing, but this requirement says the resource group must still be created, so the tag must be added rather than enforced by denial.
Can deployIfNotExists add the Department tag to a new resource group?
DeployIfNotExists deploys a template after evaluation when a condition is unmet; it is not the effect designed to mutate the incoming resource group's tag, so modify is preferred.
Related Analysis
Practice All AZ-305 Questions
Access 95 questions with complete answers and detailed explanations.
View Full AZ-305 Practice Test →