Question

A company has deployed hundreds of storage accounts across many resource groups before establishing governance standards. The compliance team now requires that all storage accounts have the 'Secure transfer required' setting enabled. They create an Azure Policy with a DeployIfNotExists effect that configures this setting. After assigning the policy, they discover that existing non-compliant storage accounts are still reporting as non-compliant and have not been fixed. What must the architect recommend to bring the existing resources into compliance automatically?

Accepted Answer

Create a remediation task for the policy assignment, ensuring the assignment has a managed identity with the required permissions.

Answer

Change the policy effect from DeployIfNotExists to Deny so that non-compliant resources are removed.

Answer

Re-evaluate the policy by triggering an on-demand compliance scan, which will automatically fix existing resources.

Answer

Move all existing storage accounts into a new resource group so the policy assignment applies to them.