Question
You need to design an Azure policy that will implement the following functionality:
✑ For new resources, assign tags and values that match the tags and values of the resource group to which the resources are deployed.
✑ For existing resources, identify whether the tags and values match the tags and values of the resource group that contains the resources.
✑ For any non-compliant resources, trigger auto-generated remediation tasks to create missing tags and values.
The solution must use the principle of least privilege.
What should you include in the design? To answer, select the appropriate options in the answer area.
Explanation
The Modify effect adds or replaces tags on resources when they are created or updated, reports existing resources whose tags do not match as non-compliant, and supports remediation tasks that fix existing resources. Append does not support remediation tasks, and EnforceOPAConstraint and EnforceRegoPolicy are for Kubernetes. Remediation tasks for Modify run under the policy assignment's managed identity, not a service principal you create. Contributor is the least-privileged option offered that can change resource tags; User Access Administrator manages role assignments only and cannot modify resources.
