Question

Your organization has a management group hierarchy: a root management group named 'Contoso' contains a child management group named 'Production', which contains two subscriptions: 'Sub-A' and 'Sub-B'. You assign an Azure Policy that denies the creation of public IP addresses at the 'Production' management group scope. Separately, a different administrator assigns a policy at 'Sub-A' that explicitly allows public IP address creation. What is the effective outcome when a user attempts to create a public IP address in 'Sub-A'?

Accepted Answer

The public IP creation is denied because a Deny effect inherited from a higher scope cannot be overridden by a policy at a lower scope.

Answer

The public IP creation is allowed because the policy assigned closest to the resource (Sub-A) takes precedence.

Answer

The public IP creation is allowed only if the Sub-A policy uses a higher priority number than the Production policy.

Answer

The two policies conflict, so the resource creation request fails with an evaluation error until an administrator resolves the conflict.