AZ-900 Describe Azure management and governance Practice Question
A company has a policy that every Azure virtual machine must have the Azure Monitor Agent installed and configured to send metrics to a central Log Analytics workspace. To enforce this requirement without relying on manual user action, the governance team wants to automatically deploy the agent to any existing or new VM that is missing it. They also need to generate a compliance report showing any VMs where the installation failed. Which Azure Policy effect should the team use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AuditIfNotExists with DeployIfNotExists, mistakenly thinking auditing alone can enforce deployment, but only DeployIfNotExists provides automatic remediation and compliance reporting for installation failures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
DeployIfNotExists
The DeployIfNotExists effect is correct because it automatically deploys the Azure Monitor Agent to any VM that does not have it, and it can trigger remediation tasks to enforce compliance. This effect also supports generating compliance reports by evaluating the deployment status and flagging VMs where the installation failed, meeting both the automatic deployment and reporting requirements without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
DeployIfNotExists
Why this is correct
DeployIfNotExists evaluates resources after creation and, if a specified resource (such as a VM extension) is absent, automatically deploys it via a linked ARM template. It triggers deployment only when the resource exists but lacks the required 'child' resource, and it reports compliance results with a remediation 'deploy' action that can be executed per non-compliant resource. This effect is ideal for ensuring an agent is present because it remediates existing and new VMs without manual intervention, though a system-assigned managed identity must have the required permissions to perform the deployment.
- ✗
AuditIfNotExists
Why it's wrong here
Incorrect. AuditIfNotExists would only check for the presence of the agent and mark the VM as non-compliant if missing, but it would not automatically deploy the agent. The scenario requires automatic remediation, not just auditing.
When this WOULD be correct
If the requirement were only to identify and report VMs missing the agent (e.g., for manual remediation or compliance auditing), without any automatic deployment, AuditIfNotExists would be the correct effect.
- ✗
Deny
Why it's wrong here
Incorrect. The Deny effect prevents the creation of a resource that does not meet the policy condition. It would block new VMs without the agent, but it would not deploy the agent to existing VMs, nor does it provide automatic remediation for non-compliance.
When this WOULD be correct
A company wants to prevent deployment of any Azure VM that does not have a specific tag (e.g., 'Environment: Production') to ensure all VMs are properly categorized. The Deny effect would block creation of non-compliant VMs.
- ✗
Modify
Why it's wrong here
Incorrect. The Modify effect is used to add, update, or remove properties or tags on the same resource being evaluated. Deploying a VM extension is a separate resource creation, which is not handled by Modify; DeployIfNotExists is designed for deploying additional resources.
When this WOULD be correct
A scenario where the governance team needs to automatically add a tag (e.g., 'Environment: Production') to all existing and new virtual machines that lack it, without deploying any additional resources. Modify would be the correct effect to enforce tag compliance.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DeployIfNotExistsCorrect answer▾
Why this is correct
DeployIfNotExists evaluates resources after creation and, if a specified resource (such as a VM extension) is absent, automatically deploys it via a linked ARM template. It triggers deployment only when the resource exists but lacks the required 'child' resource, and it reports compliance results with a remediation 'deploy' action that can be executed per non-compliant resource. This effect is ideal for ensuring an agent is present because it remediates existing and new VMs without manual intervention, though a system-assigned managed identity must have the required permissions to perform the deployment.
✗AuditIfNotExistsWrong answer — click to see why▾
Why this is wrong here
AuditIfNotExists only reports non-compliance (e.g., missing agent) but does not deploy the agent. The requirement includes automatic deployment, which AuditIfNotExists cannot perform.
★ When this WOULD be the correct answer
If the requirement were only to identify and report VMs missing the agent (e.g., for manual remediation or compliance auditing), without any automatic deployment, AuditIfNotExists would be the correct effect.
Why candidates choose this
Candidates may confuse 'audit' with 'deploy' or think that auditing alone satisfies the compliance reporting need, overlooking the deployment requirement.
✗DenyWrong answer — click to see why▾
Why this is wrong here
The Deny effect prevents creation or modification of resources that violate a policy, but it cannot automatically deploy the Azure Monitor Agent to existing or new VMs, nor can it generate a compliance report showing installation failures.
★ When this WOULD be the correct answer
A company wants to prevent deployment of any Azure VM that does not have a specific tag (e.g., 'Environment: Production') to ensure all VMs are properly categorized. The Deny effect would block creation of non-compliant VMs.
Why candidates choose this
Candidates may think Deny is the strongest enforcement mechanism and assume it can handle all compliance scenarios, not realizing it only blocks non-compliant actions without remediation or reporting capabilities.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
The Modify effect is used to add or alter properties on a resource, but it cannot deploy agents or extensions; it only changes configuration properties. The requirement to install the Azure Monitor Agent requires deploying a resource, which is done by DeployIfNotExists.
★ When this WOULD be the correct answer
A scenario where the governance team needs to automatically add a tag (e.g., 'Environment: Production') to all existing and new virtual machines that lack it, without deploying any additional resources. Modify would be the correct effect to enforce tag compliance.
Why candidates choose this
Candidates may confuse Modify with DeployIfNotExists because both can automatically remediate non-compliant resources, but Modify only changes existing properties, while DeployIfNotExists can deploy new resources like agents.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Report
A report in Azure data services is a structured output that summarizes, visualizes, or details data stored in cloud databases or data warehouses, often used for business intelligence and monitoring.
Key term
Log Analytics
Log Analytics is a cloud-based service that collects, analyzes, and visualizes machine-generated log data from various sources to help IT teams monitor systems and troubleshoot issues.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.