Cascade Regional Airlines' cloud administrator wants a single Azure Policy initiative definition for "allowed locations," but HQ should only permit resources in one region while a separate outstation-office subscription should only permit resources in a different region. How can the administrator achieve this using one initiative definition?
Select an answer to reveal the explanation.
Short Explanation
An initiative with a parameter is like one printed form with a blank line instead of a value already filled in, you use the same form everywhere but write something different in that blank each time. Parameters let one definition serve HQ and the outstation subscription differently.
Full Explanation
Azure Policy initiative and policy definitions support parameters, placeholders declared in the definition that get their actual values supplied at assignment time rather than hardcoded into the definition. For an "allowed locations" initiative, the list of permitted regions is a natural parameter: the same initiative is assigned to both HQ and the outstation subscription, but each assignment supplies its own value, one region for HQ and a different region for the outstation subscription, without duplicating the underlying definition. Creating two separate initiative definitions works technically but throws away the point of reusability, and any future change to the shared logic has to be made twice and kept in sync manually. Authoring two separate Deny policies and assigning both everywhere would allow either region at every subscription rather than restricting each to its own single region, which doesn't meet the requirement. The claim that a single definition can't vary by assignment is simply incorrect; parameterization exists to solve exactly this. One caveat: if a parameter has no default value, every assignment must explicitly supply one or the assignment fails validation. Confirm the setup by reviewing each assignment's parameter values in the Azure Policy portal and checking compliance per subscription.