A policy effect determines what Azure Policy does when a resource matches a policy rule. Each policy definition has one effect, and Azure Policy evaluates applicable assignments before Azure Resource Manager processes the request. section 10.2.3
Common effects turn governance requirements into different operational outcomes:
- Audit permits the resource but assesses it and reports compliance or noncompliance. section 10.2.3
- Deny blocks creation of a resource that fails the policy; provide a noncompliance message so users understand the reason. section 10.2.3
- Modify applies missing configuration through auto-remediation, such as adding required tags during deployment. section 10.2.3
Move an allowed-SKU policy from observation to enforcement
Assign an allowed virtual machine SKU policy with Azure CLI and begin with Audit to observe evaluation results. After confirming that legitimate deployments are not affected, switch to Deny to block disallowed SKUs and manage costs. Use a Waiver exemption for an approved resource group when noncompliance is accepted. section 10.2.2 section 10.2.3
