SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

Question

You have a management group named MG1 that includes two subscriptions, Sub1 and Sub2.

Sub1 includes a resource group named RG-Exception and a resource group named RG1 that hosts Microsoft Foundry resources.

You need to assign an Azure Policy that requires new Foundry deployments in MG1 to use private endpoints. The solution must not restrict deployments in RG-Exception.

How should you configure the policy?

Explanation

An Azure Policy assignment at management-group scope applies to resources in its child subscriptions and resource groups. A child resource group can be added to the assignment's excluded scopes (notScopes), so assigning the policy to MG1 and excluding RG-Exception enforces the private-endpoint requirement across the remaining MG1 scope without restricting deployments in that resource group.

Learn more

SC-500: Implementing End-to-End Security Controls for Cloud and AI Workloads

AstroTutor

Notes

Readiness

QuestionQ17

Community Discussion