Note: This question is part of a series of questions that present the same scenario. Each question in the series contains a unique solution that…

The proposed solution does not meet the goal. Enforcing the location of a resource group only determines where the metadata for that resource group is stored. It does not restrict the location of the resources created within that resource group. An Azure App Service instance can be deployed to a different region than its parent resource group. To meet the regulatory requirement, an Azure Policy must be configured to specifically target the location property of the App Service resource type (Microsoft.Web/sites) and deny deployments to any region not on the approved list.

A. Yes: This is incorrect because the location of a resource group and the location of the resources within it are independent. Enforcing one does not enforce the other.

1. Microsoft Docs - Azure Resource Manager - Resource groups: Under the "Resource groups" section

it states

"The resource group stores metadata about the resources... The location of the resource group can be different from the location of the resources." This directly confirms that controlling the resource group's location does not control the location of the resources it contains.

Source: Microsoft

"Azure Resource Manager overview

" Microsoft Docs

accessed October 2023. [Link: https://docs.microsoft.com/en-us/azure/azure-resource-manager/management/overview#resource-groups]

2. Microsoft Docs - Azure Policy - Built-in policy definitions: The built-in policy definition named "Allowed locations" is designed for this exact purpose. Its description states

"This policy enables you to restrict the locations your organization can specify when deploying resources." The policy logic evaluates the location field of the resource being deployed

not its resource group.

Source: Microsoft

"Azure Policy built-in definitions

" Microsoft Docs

accessed October 2023. [Link: https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies - Search for "Allowed locations"]

3. Microsoft Docs - Azure Policy - Understand policy effects: The "Deny" effect is used to prevent a resource request that doesn't match the defined standards. In this scenario

a policy with a "Deny" effect would be used to block the creation of App Service instances in non-compliant regions.

Source: Microsoft

"Understand Azure Policy effects

" Microsoft Docs

accessed October 2023. [Link: https://docs.microsoft.com/en-us/azure/governance/policy/concepts/effects#deny]