Microsoft Azure Administrator Associate AZ-104 Practice Question

To enforce that all new VMs have a 'Department' tag, you should assign an Azure Policy with a 'Deny' effect that requires this tag on VMs. Azure Policy allows you to define rules that resources must comply with, and the 'Deny' effect prevents non-compliant resources from being created. Using a resource lock is not appropriate here because locks prevent modification or deletion of resources, not control their creation properties. Azure Role-Based Access Control (RBAC) manages permissions for users and groups but doesn't enforce tagging or specific properties on resources. An Azure Policy with an 'Audit' effect would only log non-compliant resources but wouldn't prevent their creation.