Microsoft Azure Security Engineer Associate AZ-500 Practice Question

Setting the policy assignment's enforcement mode to "DoNotEnforce" tells Azure Policy to evaluate the assignment but not apply effects that would stop or change a deployment. For an assignment whose definition uses the Deny effect, Azure Policy logs the non-compliance instead of rejecting the request, giving administrators time to update deployment pipelines. Changing the enforcement mode is done at the assignment level, so the underlying policy definition remains unchanged.

Exemptions exclude specific resources or scopes from evaluation rather than keeping the policy active for all resources. A non-compliance message only customizes the error text that appears when a deny action is triggered; it does not stop the deny. An initiative groups policy assignments but does not override how individual assignments are enforced.