Which Azure Policy effect supports remediation, and what performs it?

Why the Answer Is Correct

Of the built-in Azure Policy effects, only DeployIfNotExists and Modify support remediation tasks; Audit, Deny, Append, and Disabled do not have a remediation path. Because the scenario asks specifically for remediation of new deployments while minimizing administrative effort, DeployIfNotExists is the canonical effect — it evaluates the resource and, when the related resource or configuration is missing, triggers a deployment that creates it. That deployment runs under a managed identity (system-assigned by default, or user-assigned) that Azure Policy attaches to the assignment and grants the required role, so no credentials, connection strings, or pipelines need to be maintained. This identity model is what allows a single assignment at a management group or subscription to enforce and repair configuration across many subscriptions with minimal ongoing effort.

Why Other Candidate Answers Are Wrong

Audit is the tempting distractor: it flags non-compliance but never changes anything, so it fails the 'automatic remediation' requirement. Deny blocks the deployment outright instead of remediating it after the fact. Modify comes closest conceptually and does support remediation, but the wording about deploying a companion resource points to DeployIfNotExists; Modify mutates properties of the resource already being deployed rather than deploying an additional resource. As for the remediation executor, an Automation account, Logic App, or Azure Function is not the native mechanism — the managed identity of the policy assignment is what the remediation task authenticates with, which is why the identity is the correct selection for the second dropdown.

Community Comment Notes

AllanHouston summarized the reasoning the community converges on: "Effect: DeployIfNotExists" and "Resource: A managed identity", noting that policy uses a managed identity "tied directly to the policy assignment" granted the permissions needed to fix non-compliant infrastructure. The practical takeaway from that thread is that remediation is an identity-bound operation, so role assignments at the assignment scope must be in place before remediation tasks can succeed. That also explains why grants can take time to propagate after a new assignment is created.