Question
An Azure Policy denying the creation of Public IP addresses is assigned at the Root Management Group level with no exclusions. An administrator creates an Exemption for a specific Subscription within that hierarchy. If a deployment script attempts to create a Virtual Machine with a Public IP inside that subscription, what happens during policy evaluation? Explain the exact evaluation mechanics.
Tap card to flipAnswer
The VM deployment succeeds. During resource deployment, Azure Resource Manager (ARM) evaluates Policy assignments applied across all parent scopes (Root, Management Groups, Subscription, Resource Group). However, before enforcing a "Deny" policy, ARM checks for valid Policy Exemptions targeting the specific scope or resource. Because a explicit Exemption exists at the Subscription level, ARM bypasses the enforcement of the inherited "Deny" policy for resources created within that subscription. Policy exemptions explicitly override inherited policy assignments, regardless of how high up the parent hierarchy the policy was assigned.
Tap card to flip back