Existing lock-lab Key Vaults remain Non-compliant for diagnostic settings even after a DeployIfNotExists policy assignment is live. What does the security engineer need so already-deployed vaults become compliant?
Select an answer to reveal the explanation.
Short Explanation
Deny only stops the next bad deploy. For vaults already sitting there Non-compliant, give the assignment a managed identity and fire a remediation task so DeployIfNotExists or Modify can catch up.
Full Explanation
DeployIfNotExists and Modify evaluate existing resources but do not silently rewrite them until a remediation task runs using the assignment’s managed identity. Deny blocks non-compliant create or update operations going forward; it does not remediate inventory already present. Removing the managed identity prevents remediation. Full IaC redeploys are optional operational work, not the Policy remediation control AZ-500 tests here.