How to Enforce Naming Conventions with Azure Policy Deny Effect
A company wants to enforce a naming convention for all Azure resources. For example, all resources must start with 'Contoso-'. They want to automatically audit and deny creation of resources that do not follow the naming convention. Which Azure Policy effect should they use?
Quick Answer
The answer is the Deny effect. This is correct because the Deny effect actively blocks the creation or update of any Azure resource that violates the policy rule, such as a naming convention requiring all resources to start with 'Contoso-'. When a deployment attempt fails the condition, Azure Policy returns a 403 Forbidden status, preventing the non-compliant resource from ever being provisioned. On the Microsoft Azure Fundamentals AZ-900 exam, this scenario tests your understanding of how Azure Policy effects enforce compliance at the point of creation, distinguishing Deny from effects like Audit (which only logs violations) or DeployIfNotExists (which remediates after creation). A common trap is confusing Deny with Audit, but remember: Deny stops the action cold, while Audit merely warns you. For a memory tip, think of a bouncer at a club—Deny is the bouncer who refuses entry at the door, ensuring only resources with the right name get in.
⚠ Common exam trap
Candidates often confuse 'Audit' (which only reports non-compliance) with 'Deny' (which actively blocks non-compliant deployments), leading them to choose Audit because they think auditing is sufficient for enforcement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deny
The Deny effect is correct because it actively prevents the creation of Azure resources that do not match the defined naming convention rule, such as requiring all resources to start with 'Contoso-'. This effect evaluates the resource against the policy rule during deployment and rejects the request with a 403 Forbidden status if the condition is not met, ensuring compliance before the resource is created.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Deny
Why this is correct
Deny blocks creation of resources that violate the naming rule.
- ✗
Audit
Why it's wrong here
Audit only logs non-compliance, it does not prevent creation.
When this WOULD be correct
Use Audit when the goal is to evaluate compliance of existing resources and log violations without preventing creation, such as for a pilot policy to assess current naming convention adherence before enforcing denial.
- ✗
Modify
Why it's wrong here
Modify can change properties but does not deny creation.
When this WOULD be correct
If the question asked for automatically adding a missing tag (e.g., 'Department: Finance') to resources during creation, Modify would be correct because it can add or alter properties without blocking creation.
- ✗
Append
Why it's wrong here
Append adds additional fields but does not deny creation.
When this WOULD be correct
If the question asked for automatically adding a tag (e.g., 'Department: Finance') to all resources that lack it, without blocking creation, then Append would be correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The AZ-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓DenyCorrect answer▾
Why this is correct
Deny blocks creation of resources that violate the naming rule.
✗AuditWrong answer — click to see why▾
Why this is wrong here
Audit only logs non-compliant resources without blocking creation, but the requirement is to automatically deny creation of resources that don't follow the naming convention.
★ When this WOULD be the correct answer
Use Audit when the goal is to evaluate compliance of existing resources and log violations without preventing creation, such as for a pilot policy to assess current naming convention adherence before enforcing denial.
Why candidates choose this
Candidates may think Audit is sufficient for compliance monitoring, overlooking the explicit need to deny non-compliant resource creation.
✗ModifyWrong answer — click to see why▾
Why this is wrong here
The Modify effect can add or change tags, but it cannot deny resource creation. The question requires denying resources that don't follow the naming convention, which Modify cannot do.
★ When this WOULD be the correct answer
If the question asked for automatically adding a missing tag (e.g., 'Department: Finance') to resources during creation, Modify would be correct because it can add or alter properties without blocking creation.
Why candidates choose this
Candidates may confuse Modify with Deny because both can alter resource behavior, but Modify is for adding/changing properties, not for blocking non-compliant resources.
✗AppendWrong answer — click to see why▾
Why this is wrong here
The Append effect adds fields or tags to a resource during creation or update, but it does not block creation. The company requires denying creation of non-compliant resources, which only the Deny effect can do.
★ When this WOULD be the correct answer
If the question asked for automatically adding a tag (e.g., 'Department: Finance') to all resources that lack it, without blocking creation, then Append would be correct.
Why candidates choose this
Candidates may confuse Append with Deny because both can enforce naming conventions, but Append only adds missing elements rather than rejecting non-compliant resources.
Analysis generated from the official AZ-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on AZ-900
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a policy that all Azure resources must have a 'CostCenter' tag. They want to automatically audit and deny the creation of any resource that does not include this tag. Which Azure Policy effect should they use?
medium- ✓ A.Deny
- B.Audit
- C.Append
- D.DeployIfNotExists
Why A: The 'Deny' effect is correct because the company's policy requires that any resource creation attempt missing the 'CostCenter' tag must be blocked entirely, not just reported or modified. Azure Policy's Deny effect actively prevents the resource from being provisioned by rejecting the API call at the Azure Resource Manager level, ensuring non-compliant resources are never created.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.