How to Automatically Remediate Existing Non-Compliant VMs Using Azure Policy DeployIfNotExists
A company uses Azure Policy to enforce that all virtual machines must have the Azure Monitor agent extension installed. The policy is assigned to a subscription and uses the 'DeployIfNotExists' effect, which automatically installs the agent on new VMs. However, the security team notices that several existing VMs are non-compliant because they were provisioned before the policy was assigned. The team wants to automatically make these existing VMs compliant without manual intervention. What should the team do?
Quick Answer
The answer is to create a remediation task for the policy assignment. This is correct because a DeployIfNotExists policy effect automatically handles new resources, but it does not retroactively scan or fix existing non-compliant VMs. A remediation task explicitly triggers the policy engine to evaluate all pre-existing resources in the scope, identify those missing the Azure Monitor agent, and deploy the extension automatically, closing the compliance gap without manual intervention. On the AZ-900 exam, this scenario tests your understanding that DeployIfNotExists policies require a separate remediation step for existing resources, which is a common trap—many candidates assume the effect applies to everything automatically. Remember the key distinction: DeployIfNotExists covers new resources, while remediation tasks handle the backlog of existing non-compliant VMs. A useful memory tip is "New gets Deploy, Old needs Remediate"—if it existed before the policy assignment, you must run a remediation task to make it compliant.
⚠ Common exam trap
Watch out — candidates often confuse 'Deny' (which blocks future non-compliant actions) with 'DeployIfNotExists' (which requires a remediation task to fix existing resources), leading them to incorrectly choose option B thinking it will enforce compliance retroactively.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create a remediation task for the policy assignment.
A remediation task on a 'DeployIfNotExists' policy assignment triggers the policy engine to evaluate existing non-compliant resources and automatically deploy the required extension (Azure Monitor agent) to those VMs. This is the designed mechanism to bring pre-existing resources into compliance without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create a remediation task for the policy assignment.
Why this is correct
Correct: A remediation task automatically scans existing resources and applies the 'DeployIfNotExists' effect to bring them into compliance. This is the intended mechanism for remediating non-compliant resources that existed before the policy was assigned.
- ✗
Change the policy effect to 'Deny'.
Why it's wrong here
Incorrect: Changing the effect to 'Deny' would block creation of non-compliant new VMs but would not remediate existing non-compliant VMs. It does not deploy the agent automatically.
When this WOULD be correct
A question where the goal is to prevent future non-compliant resource creation, such as 'A company wants to ensure no new VMs are created without the Azure Monitor agent. What policy effect should be used?'
- ✗
Assign the policy at the management group scope.
Why it's wrong here
Incorrect: Changing the assignment scope to a management group does not trigger remediation of existing resources. It only expands the group of subscriptions and resource groups where the policy is applied to new resources.
When this WOULD be correct
A company wants to enforce a policy across multiple subscriptions that are organized under a management group, and the policy should apply to all new resources in those subscriptions. The correct action would be to assign the policy at the management group scope to ensure consistent enforcement.
- ✗
Use Azure Automation Update Management.
Why it's wrong here
Incorrect: Azure Automation Update Management is designed to manage operating system updates and patches, not to deploy extensions or enforce Azure Policy compliance. It does not install the Azure Monitor agent.
When this WOULD be correct
A company wants to ensure that all virtual machines are automatically patched with the latest security updates on a regular schedule. Azure Automation Update Management would be the correct solution to manage and schedule updates across VMs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Create a remediation task for the policy assignment.Correct answer▾
Why this is correct
Correct: A remediation task automatically scans existing resources and applies the 'DeployIfNotExists' effect to bring them into compliance. This is the intended mechanism for remediating non-compliant resources that existed before the policy was assigned.
✗Change the policy effect to 'Deny'.Wrong answer — click to see why▾
Why this is wrong here
Changing the policy effect to 'Deny' would block creation of non-compliant VMs but does not remediate existing non-compliant VMs that were provisioned before the policy was assigned.
★ When this WOULD be the correct answer
A question where the goal is to prevent future non-compliant resource creation, such as 'A company wants to ensure no new VMs are created without the Azure Monitor agent. What policy effect should be used?'
Why candidates choose this
Candidates may think 'Deny' is a stronger enforcement that will also fix existing resources, but it only affects new deployments, not existing ones.
✗Assign the policy at the management group scope.Wrong answer — click to see why▾
Why this is wrong here
Assigning the policy at the management group scope would apply the policy to all subscriptions under that management group, but it does not automatically remediate existing non-compliant VMs. The 'DeployIfNotExists' effect requires a remediation task to fix existing resources.
★ When this WOULD be the correct answer
A company wants to enforce a policy across multiple subscriptions that are organized under a management group, and the policy should apply to all new resources in those subscriptions. The correct action would be to assign the policy at the management group scope to ensure consistent enforcement.
Why candidates choose this
Candidates may think that assigning at a higher scope (management group) automatically fixes existing resources, or they may confuse scope assignment with remediation capabilities.
✗Use Azure Automation Update Management.Wrong answer — click to see why▾
Why this is wrong here
Azure Automation Update Management is designed to manage OS updates and patches, not to enforce compliance with Azure Policy or install extensions on existing VMs. It does not address the DeployIfNotExists policy's remediation for existing resources.
★ When this WOULD be the correct answer
A company wants to ensure that all virtual machines are automatically patched with the latest security updates on a regular schedule. Azure Automation Update Management would be the correct solution to manage and schedule updates across VMs.
Why candidates choose this
Candidates may confuse 'Update Management' with 'remediation' or think it can handle extension deployment, as both involve automated actions on VMs. The name 'Update Management' sounds like it could manage compliance updates.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Azure Cost Management and Billing
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
Key term
Task
A Task in Azure DevOps is a predefined, reusable step that performs a specific action during a build or release pipeline, like compiling code or running tests.
About these practice questions
Courseiva writes every AZ-900 question from scratch — 981 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
8 more ways this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses Azure Policy to enforce that all virtual machines must be from an approved list of SKUs. They want to ensure that any non-compliant VMs that already exist are automatically remediated by changing the VM size to a compliant SKU. Which policy effect should they use?
hard- A.Deny
- B.Audit
- C.Append
- ✓ D.Modify
Why D: The Modify effect is correct because it allows Azure Policy to automatically change non-compliant resources to a compliant state during evaluation. In this scenario, it can alter the VM size to an approved SKU without manual intervention, ensuring continuous compliance.
Variation 2. A company has multiple Azure subscriptions. They need to enforce a rule that only specific virtual machine sizes (e.g., Standard_D2s_v3) can be used across all subscriptions. They also want this rule to automatically apply to any future subscriptions created. Which Azure service should they use?
medium- ✓ A.Azure Policy
- B.Azure Blueprints
- C.Azure Role-Based Access Control (RBAC)
- D.Azure Resource Manager
Why A: Azure Policy is the correct service because it allows you to create, assign, and manage policies that enforce specific rules (such as allowed virtual machine SKUs) across your Azure environment. By assigning a built-in or custom policy definition (e.g., 'Allowed virtual machine SKUs') at the management group scope, the rule automatically applies to all existing and future subscriptions within that management group, ensuring consistent governance without manual intervention.
Variation 3. A company wants to enforce a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically apply the tag to new resources, and also to existing resources that are missing it. Which Azure service should they use?
easy- ✓ A.Azure Policy
- B.Azure Blueprints
- C.Azure Resource Manager
- D.Azure Cost Management
Why A: Azure Policy is the correct service because it can enforce tagging rules by evaluating resources against a policy definition and automatically applying the 'CostCenter' tag to new resources via the 'deployIfNotExists' effect. It can also remediate existing non-compliant resources by triggering a remediation task that applies the missing tag. This makes Azure Policy the ideal tool for governance and compliance at scale.
Variation 4. A company wants to ensure that all resources in their Azure environment are created with mandatory tags for cost tracking. They have already assigned a policy to append tags, but existing resources are still missing tags. They want to automatically add the tags to existing resources without manual intervention. What should they do?
medium- A.Modify the policy effect to 'deny' instead of 'append'.
- ✓ B.Create a remediation task for the policy.
- C.Use Azure Resource Graph to identify and manually tag.
- D.Reassign the policy with a new scope.
Why B: None of the provided options correctly solve the problem. The 'append' effect does not support remediation tasks; remediation tasks are only available for 'deployIfNotExists' and 'modify' effects. To automatically add tags to existing resources, the policy effect must be changed to 'modify', and then a remediation task can be created. This option is not listed.
Variation 5. A company needs to ensure that all Azure resources have a mandatory 'CostCenter' tag. If a resource is created without this tag, the resource creation should be blocked. Which Azure Policy effect should they use?
easy- A.Append
- ✓ B.Deny
- C.Audit
- D.DeployIfNotExists
Why B: The Deny effect is correct because it actively blocks any resource creation or update that does not comply with the policy rule, such as missing the mandatory 'CostCenter' tag. This ensures that non-compliant resources are never provisioned, enforcing governance at the point of creation.
Variation 6. A company wants to ensure that all Azure resources are tagged with a 'CostCenter' tag at creation time. If a resource is created without the tag, it should be automatically denied. Which Azure Policy effect should they use?
easy- ✓ A.A) deny
- B.B) audit
- C.C) append
- D.D) deployIfNotExists
Why A: The 'deny' effect is correct because it actively blocks any resource creation request that does not include the required 'CostCenter' tag. Azure Policy with the 'deny' effect evaluates the resource against the policy rule at creation or update time and rejects the request if the condition is not met, ensuring compliance before the resource is provisioned.
Variation 7. A company wants to ensure that all Azure resources are tagged with metadata such as 'Environment' and 'Department'. They have created an Azure Policy that appends the required tags and their values when a resource is created. However, they notice that some resources created before the policy assignment are missing tags. They want to automatically add those tags without manual effort. What should they do?
medium- A.Create a remediation task for the policy
- ✓ B.Create a new policy with DeployIfNotExists effect
- C.Use Azure Resource Graph to query and update
- D.Create an Azure Automation runbook
Why B: The DeployIfNotExists (DINE) policy effect can automatically remediate non-compliant resources, including those created before the policy assignment. When combined with a managed identity, DINE triggers a deployment task that adds the required tags without manual intervention, addressing the gap left by the 'append' effect which only acts on new resources.
Variation 8. A company has a governance requirement that every Azure virtual machine must have a tag named 'CostCenter' with the value 'Unassigned'. If a user creates a VM without the tag, or with a different value for that tag, the tag should be automatically corrected to 'Unassigned' immediately upon resource creation. The IT team is writing an Azure Policy definition to enforce this. Which Policy effect should they use?
medium- A.Deny
- B.Audit
- ✓ C.Modify
- D.DeployIfNotExists
Why C: The Modify effect is correct because it automatically corrects non-compliant tags (missing or wrong value) to the specified value ('Unassigned') during resource creation or update, without blocking the deployment. This satisfies the requirement for immediate, automatic remediation without denying the VM creation entirely.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.