A company has 30 Azure subscriptions organized under a single management group. The governance team wants to enforce that all resource groups must have a specific tag 'CostCenter' with a valid value. They create an Azure Policy definition with the 'Deny' effect and assign it to the root management group. However, the development team complains that they have a sandbox subscription where they need to create resource groups without the 'CostCenter' tag for testing. The governance team still wants the policy to apply to all other subscriptions but exempt the sandbox subscription. Which solution should the governance team use?

Create a second policy assignment at the sandbox subscription with the 'Disabled' effect.

Azure Policy does not support a 'Disabled' effect. You cannot override a parent policy assignment by assigning the same policy with a different effect at a child scope. The only way to exclude a scope from a policy assignment is to use an exemption.

Remove the policy assignment from the management group and assign it individually to all subscriptions except the sandbox.

This approach is extremely inefficient and error-prone for 30 subscriptions. It defeats the purpose of using a management group to apply policy centrally. The correct method is to keep the management group assignment and use an exemption for the sandbox.

Configure an Azure Blueprint for the management group and exclude the sandbox subscription.

Azure Blueprints can include policy assignments, but they do not have a built-in exclusion mechanism. To exclude a subscription from a blueprint's policy assignment, you would still need to create an exemption on that subscription. Additionally, moving from a direct policy assignment to a blueprint is unnecessary complexity.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Use a policy exemption on the sandbox subscription with category 'Waiver'. — Azure Policy exemptions allow you to exclude a specific scope (like a subscription or resource group) from the enforcement of a policy assignment. Exemptions can have a category of 'Waiver' or 'Mitigated'. In this scenario, creating a policy exemption with category 'Waiver' on the sandbox subscription effectively removes the policy requirement for that subscription only, while the Deny effect continues to apply to all other subscriptions under the management group. This is the intended method for scoped exclusion without modifying the original assignment.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.