A contractor still creates a public-access storage account after “t…

Question

A contractor still creates a public-access storage account after “the policy is on.” Which Azure Policy effect actually blocks that create or update?

Accepted Answer

Use the Deny effect so non-compliant creates or updates are blocked; Audit or AuditIfNotExists only report Non-compliant — Audit is a referee with a notepad—flags the foul, doesn’t stop the play. Deny is the whistle that kills the create. If public storage still appears, you probably assigned a reporter, not a blocker.

Answer

Use Audit only, because Audit always prevents resource creation in Azure Resource Manager

Answer

Use an NSG Deny rule on a subnet and treat that as Azure Policy enforcement for storage account public access

Answer

Use DeployIfNotExists exclusively whenever the goal is to stop the create request before it succeeds

A contractor still creates a public-access storage account after “the policy is on.” Which Azure Policy effect actually blocks that create or update?

Short Explanation

Full Explanation