Question

You assign a new Azure Policy with a 'deny' effect that prohibits creating storage accounts that allow public blob access. Several storage accounts with public blob access already existed in the scope before the assignment. After the assignment, you check the policy's compliance report but notice the existing storage accounts are not yet listed. What is the MOST likely reason the existing resources are not reflected as non-compliant?

Accepted Answer

A compliance evaluation scan has not yet completed; policy evaluation of existing resources can take up to 24 hours or requires an on-demand scan.

Answer

The 'deny' effect only applies to future resource creation and never evaluates existing resources for compliance.

Answer

Existing resources must be manually added to the policy assignment before they can be evaluated.

Answer

The policy assignment requires a managed identity before any compliance data is generated.