The canal authority wants every new Key Vault in every subscription…

Question

The canal authority wants every new Key Vault in every subscription to have purge protection. Where should you assign the built-in Azure Policy (or initiative that includes it) so child subscriptions inherit?

Accepted Answer

Assign the policy or initiative at the management group that contains the canal subscriptions — One resource group assignment is a sticky note on one desk. Park the purge-protection policy at the management group and every child subscription inherits the house rule.

Answer

Assign the policy only on the lock-lab resource group that holds today’s vaults

Answer

Assign the policy on a single Key Vault resource and rely on peers to copy the setting

Answer

Skip Azure Policy and email a reminder to enable purge protection after each vault is created

The canal authority wants every new Key Vault in every subscription to have purge protection. Where should you assign the built-in Azure Policy (or initiative that includes it) so child subscriptions inherit?

Short Explanation

Full Explanation