Question
You have a management group named MG1 that contains two subscriptions named Sub1 and Sub2.
Sub1 contains a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.
You need to assign an Azure policy to force new Foundry deployments in MG1 to use private endpoints. The solution must NOT restrict deployments in RG-Exception.
How should you configure the policy?
- A. Assign the policy to MG1 and exclude RG-Exception. Correct
- B. Assign the policy to Sub1 and RG-Exception.
- C. Assign the policy to MG1 and RG-Exception.
- D. Assign the policy to Sub1 and exclude RG-Exception.
Explanation
An assignment at MG1 applies to all child subscriptions and resource groups, so it covers both Sub1 and Sub2, and an excluded scope removes RG-Exception from evaluation. Assigning at Sub1 would leave Sub2 uncovered even with the exclusion. The options that assign the policy to RG-Exception apply the restriction to the very resource group that must stay unrestricted.
