A company has an Azure subscription with multiple resource groups. The governance team wants to ensure that every new resource created in the subscription automatically receives a 'Department' tag with a default value of 'Finance' if the creator did not specify one. The team wants the tag to be applied without blocking the creation of the resource. Which Azure feature should they use?

Azure Policy with the 'Deny' effect

The 'Deny' effect would block the creation of any resource that does not have the 'Department' tag. This is not what the team wants because they want the resource to be created and the tag to be automatically added, not blocked.

Azure Resource Lock

Azure Resource Locks are used to prevent accidental deletion or modification of resources. They do not automatically add tags or enforce tagging policies.

Azure role-based access control (RBAC) with a custom role

Azure RBAC manages permissions for who can perform actions on resources. It does not automatically add tags to resources during creation. A custom role could be created, but it cannot automatically apply tags; it only grants or denies permissions.

What does this AZ-900 question test?

Standard ACLs match source addresses.

What is the correct answer to this question?

The correct answer is: Azure Policy with the 'Append' effect — Azure Policy provides various effects to control resource compliance. The 'Append' effect can automatically add required fields (like tags) to a resource during creation or update. This allows the resource to be created successfully while still enforcing the tag. The 'Deny' effect would block creation if the tag is missing. Azure Resource Locks prevent accidental deletion or modification but do not add tags. Azure RBAC manages permissions, not automatic resource configuration.

What should I do if I get this AZ-900 question wrong?

Then try more questions from the same exam bank and focus on understanding why the wrong options are tempting.