Tagging and cost allocation do not automatically create notification delivery. In this case, a Bicep deployment is technically valid but denied in an unapproved region. “Budget notification configuration and contact recipients” would not satisfy that requirement; the supported action is “Choose a policy-permitted region instead of bypassing governance”. Policy evaluation applies to compliant deployments independent of template syntax.

Cost Management budget notifications can route threshold emails to recipients. In this case, a Bicep deployment is technically valid but denied in an unapproved region. “Budget alert notification contact settings” would not satisfy that requirement; the supported action is “Choose a policy-permitted region instead of bypassing governance”. Policy evaluation applies to compliant deployments independent of template syntax.

Moving an Azure resource can require moving related dependent resources together. In this case, a Bicep deployment is technically valid but denied in an unapproved region. “Supported move requirements for the VM and associated resources” would not satisfy that requirement; the supported action is “Choose a policy-permitted region instead of bypassing governance”. Policy evaluation applies to compliant deployments independent of template syntax.

Tenant separation is a much broader identity boundary than ordinary cost allocation. In this case, a budget notification must be delivered to a shared operations distribution list. “Use subscription and management hierarchy for billing governance where suitable” would not satisfy that requirement; the supported action is “Budget alert notification contact settings”. Cost Management budget notifications can route threshold emails to recipients.

Subscriptions and management groups support governance segmentation under a shared directory. In this case, a budget notification must be delivered to a shared operations distribution list. “Separate subscription or management-group scope within the existing tenant” would not satisfy that requirement; the supported action is “Budget alert notification contact settings”. Cost Management budget notifications can route threshold emails to recipients.

Policy evaluation applies to compliant deployments independent of template syntax. In this case, a budget notification must be delivered to a shared operations distribution list. “Choose a policy-permitted region instead of bypassing governance” would not satisfy that requirement; the supported action is “Budget alert notification contact settings”. Cost Management budget notifications can route threshold emails to recipients.

Subscriptions and management groups support governance segmentation under a shared directory. In this case, a department does not receive budget alert emails after adding its tag. “Separate subscription or management-group scope within the existing tenant” would not satisfy that requirement; the supported action is “Budget notification configuration and contact recipients”. Tagging and cost allocation do not automatically create notification delivery.

Tenant separation is a much broader identity boundary than ordinary cost allocation. In this case, a department does not receive budget alert emails after adding its tag. “Use subscription and management hierarchy for billing governance where suitable” would not satisfy that requirement; the supported action is “Budget notification configuration and contact recipients”. Tagging and cost allocation do not automatically create notification delivery.

Policy evaluation applies to compliant deployments independent of template syntax. In this case, a department does not receive budget alert emails after adding its tag. “Choose a policy-permitted region instead of bypassing governance” would not satisfy that requirement; the supported action is “Budget notification configuration and contact recipients”. Tagging and cost allocation do not automatically create notification delivery.

Tagging and cost allocation do not automatically create notification delivery. In this case, a newly created department wants to isolate cost and policy controls without creating another tenant. “Budget notification configuration and contact recipients” would not satisfy that requirement; the supported action is “Separate subscription or management-group scope within the existing tenant”. Subscriptions and management groups support governance segmentation under a shared directory.

Audit records noncompliance without blocking the create or update. In this case, a newly created department wants to isolate cost and policy controls without creating another tenant. “Audit effect rather than Deny” would not satisfy that requirement; the supported action is “Separate subscription or management-group scope within the existing tenant”. Subscriptions and management groups support governance segmentation under a shared directory.

Audit signals violations but cannot enforce a blocking outcome. In this case, a newly created department wants to isolate cost and policy controls without creating another tenant. “Use an enforcing Deny effect where appropriate” would not satisfy that requirement; the supported action is “Separate subscription or management-group scope within the existing tenant”. Subscriptions and management groups support governance segmentation under a shared directory.

Audit signals violations but cannot enforce a blocking outcome. In this case, a team proposes a new tenant for every cost center. “Use an enforcing Deny effect where appropriate” would not satisfy that requirement; the supported action is “Use subscription and management hierarchy for billing governance where suitable”. Tenant separation is a much broader identity boundary than ordinary cost allocation.

Audit records noncompliance without blocking the create or update. In this case, a team proposes a new tenant for every cost center. “Audit effect rather than Deny” would not satisfy that requirement; the supported action is “Use subscription and management hierarchy for billing governance where suitable”. Tenant separation is a much broader identity boundary than ordinary cost allocation.

Tagging and cost allocation do not automatically create notification delivery. In this case, a team proposes a new tenant for every cost center. “Budget notification configuration and contact recipients” would not satisfy that requirement; the supported action is “Use subscription and management hierarchy for billing governance where suitable”. Tenant separation is a much broader identity boundary than ordinary cost allocation.

Tags provide searchable metadata for management and inventory. In this case, a policy audits resources lacking a tag but does not stop deployment. “Resource inventory filtering or queries based on tags” would not satisfy that requirement; the supported action is “Audit effect rather than Deny”. Audit records noncompliance without blocking the create or update.

Names are not a guaranteed reliable governance boundary across teams. In this case, a policy audits resources lacking a tag but does not stop deployment. “Filter resources using the standardized environment tag” would not satisfy that requirement; the supported action is “Audit effect rather than Deny”. Audit records noncompliance without blocking the create or update.

Subscriptions and management groups support governance segmentation under a shared directory. In this case, a policy audits resources lacking a tag but does not stop deployment. “Separate subscription or management-group scope within the existing tenant” would not satisfy that requirement; the supported action is “Audit effect rather than Deny”. Audit records noncompliance without blocking the create or update.

Tags provide searchable metadata for management and inventory. In this case, an administrator expects Audit to reject a resource creation and it succeeds. “Resource inventory filtering or queries based on tags” would not satisfy that requirement; the supported action is “Use an enforcing Deny effect where appropriate”. Audit signals violations but cannot enforce a blocking outcome.

Tenant separation is a much broader identity boundary than ordinary cost allocation. In this case, an administrator expects Audit to reject a resource creation and it succeeds. “Use subscription and management hierarchy for billing governance where suitable” would not satisfy that requirement; the supported action is “Use an enforcing Deny effect where appropriate”. Audit signals violations but cannot enforce a blocking outcome.

Names are not a guaranteed reliable governance boundary across teams. In this case, an administrator expects Audit to reject a resource creation and it succeeds. “Filter resources using the standardized environment tag” would not satisfy that requirement; the supported action is “Use an enforcing Deny effect where appropriate”. Audit signals violations but cannot enforce a blocking outcome.

Audit signals violations but cannot enforce a blocking outcome. In this case, an auditor needs to locate resources with the same Environment tag across resource groups. “Use an enforcing Deny effect where appropriate” would not satisfy that requirement; the supported action is “Resource inventory filtering or queries based on tags”. Tags provide searchable metadata for management and inventory.

Audit records noncompliance without blocking the create or update. In this case, an auditor needs to locate resources with the same Environment tag across resource groups. “Audit effect rather than Deny” would not satisfy that requirement; the supported action is “Resource inventory filtering or queries based on tags”. Tags provide searchable metadata for management and inventory.

Budget availability is independent of capacity/quota limits. In this case, an auditor needs to locate resources with the same Environment tag across resource groups. “Available vCPU quota for the chosen VM family and region” would not satisfy that requirement; the supported action is “Resource inventory filtering or queries based on tags”. Tags provide searchable metadata for management and inventory.

Audit records noncompliance without blocking the create or update. In this case, a report includes multiple similarly named VMs but only prod matters. “Audit effect rather than Deny” would not satisfy that requirement; the supported action is “Filter resources using the standardized environment tag”. Names are not a guaranteed reliable governance boundary across teams.

Budget availability is independent of capacity/quota limits. In this case, a report includes multiple similarly named VMs but only prod matters. “Available vCPU quota for the chosen VM family and region” would not satisfy that requirement; the supported action is “Filter resources using the standardized environment tag”. Names are not a guaranteed reliable governance boundary across teams.

Azure quotas bound resources by service, scope and region. In this case, a report includes multiple similarly named VMs but only prod matters. “Request a relevant service quota increase for the subscription and region” would not satisfy that requirement; the supported action is “Filter resources using the standardized environment tag”. Names are not a guaranteed reliable governance boundary across teams.

A newly assigned deny policy does not necessarily retroactively mutate old resources. In this case, a subscription is nearing its configured regional vCPU quota. “Assess existing resources and remediate their settings according to policy” would not satisfy that requirement; the supported action is “Request a relevant service quota increase for the subscription and region”. Azure quotas bound resources by service, scope and region.

Azure Policy can enforce storage-account networking compliance. In this case, a subscription is nearing its configured regional vCPU quota. “Use a deny policy for unsupported public-network configurations” would not satisfy that requirement; the supported action is “Request a relevant service quota increase for the subscription and region”. Azure quotas bound resources by service, scope and region.

Names are not a guaranteed reliable governance boundary across teams. In this case, a subscription is nearing its configured regional vCPU quota. “Filter resources using the standardized environment tag” would not satisfy that requirement; the supported action is “Request a relevant service quota increase for the subscription and region”. Azure quotas bound resources by service, scope and region.

A newly assigned deny policy does not necessarily retroactively mutate old resources. In this case, an organization sees VM creation failing despite low cost spend. “Assess existing resources and remediate their settings according to policy” would not satisfy that requirement; the supported action is “Available vCPU quota for the chosen VM family and region”. Budget availability is independent of capacity/quota limits.

Azure Policy can enforce storage-account networking compliance. In this case, an organization sees VM creation failing despite low cost spend. “Use a deny policy for unsupported public-network configurations” would not satisfy that requirement; the supported action is “Available vCPU quota for the chosen VM family and region”. Budget availability is independent of capacity/quota limits.

Names are not a guaranteed reliable governance boundary across teams. In this case, an organization sees VM creation failing despite low cost spend. “Filter resources using the standardized environment tag” would not satisfy that requirement; the supported action is “Available vCPU quota for the chosen VM family and region”. Budget availability is independent of capacity/quota limits.