Forum Discussion
Azure Policy Deploy If Not Exist Permissions
Currently we use Azure Deploy if not exist policies to enforce specific settings on various azure resources which is triggered when a resource is deployed. And in order to segregate permission we gra...
Yes, this behavior is by design. Azure Policy DeployIfNotExists effect requires a managed identity with sufficient permissions to perform remediation, but the initial evaluation and triggering of the deployment occur in the context of the user request. If the user lacks the necessary permissions, the remediation deployment fails. You must execute using the managed identity assigned to the policy, not the user identity.