Question

Your company requires that no storage accounts be created without secure transfer (HTTPS) enabled. You author an Azure Policy definition and assign it at the subscription scope. However, the compliance team notes that several developers are still successfully creating non-compliant storage accounts, and the policy is only flagging them afterward in the compliance report. You need to prevent these non-compliant resources from being created in the first place, without affecting resources that already exist. What should you do?

Accepted Answer

Change the policy effect from Audit to Deny and reassign the policy.

Answer

Change the policy effect from Audit to DeployIfNotExists and create a remediation task.

Answer

Add a resource lock of type ReadOnly to the subscription scope.

Answer

Change the policy effect to Modify and add the required tags.