Question

A financial services company must ensure that all new resources are deployed only to the 'West Europe' and 'North Europe' regions to meet data residency requirements. The compliance team also needs a report of any existing resources that already violate this rule, but they do not want the reporting process to delete or modify any current resources. You must recommend a governance approach that enforces the restriction on future deployments while surfacing existing violations. What should you recommend?

Accepted Answer

Assign an Azure Policy definition with the 'deny' effect for disallowed locations, and rely on the policy's automatic compliance evaluation to report existing non-compliant resources.

Answer

Apply an Azure Blueprint that provisions only resources in the allowed regions and use Azure Monitor alerts to detect resources in other regions.

Answer

Assign an Azure Policy with the 'modify' effect to relocate non-compliant resources and generate a remediation task report.

Answer

Use a resource lock at the subscription scope to prevent creation in disallowed regions and export the activity log for compliance reporting.