Azure policy containing deployifnotexist is not able to be scoped to be the root tenant management group

Hello @Ayiba Chinwe

When a policy with the DeployIfNotExists effect is assigned at the tenant root management group, Azure does not support remediation tasks at that scope. Because of this platform limitation, the Remediation tab correctly shows that the policy does not support remediation, and the checkbox to create remediation tasks is not available. However, when the same policy is assigned at a subscription or lower management group, the remediation option becomes available and works as expected.

This happens due to below following reasons:

• DeployIfNotExists remediation tasks run ARM deployments to bring existing non‑compliant resources into compliance.
• ARM deployments require a subscription or resource group deployment context.
• The tenant root management group does not provide a deployment context, so remediation tasks cannot be executed there.
• As a result, Azure Policy disables remediation tasks at the tenant root management group, even though the policy itself can still be assigned at that level.

Remediation tasks are used to remediate existing resources and rely on ARM deployments, which explains why remediation is only supported at subscription or lower scopes and not at tenant root scope.

Official documentation:

• DeployIfNotExists effect overview: https://learn.microsoft.com/azure/governance/policy/concepts/effect-deploy-if-not-exists
• Remediation behavior for existing resources: https://learn.microsoft.com/azure/governance/policy/how-to/remediate-resources

Even though remediation tasks are not supported at the tenant root management group, the DeployIfNotExists effect itself still works for new resources. This means:

• New resources created under child management groups or subscriptions are automatically remediated through policy inheritance.
• Existing resources cannot be remediated from the tenant root management group and require a lower-scope assignment.

As a workaround please have a look into below approaches:

• Assign the policy or initiative at the tenant root management group for centralized governance and inheritance.
• Assign the same policy (or initiative) at child management groups or subscriptions where remediation of existing resources is required.
• Run remediation tasks only at those supported scopes.

This approach is consistent with Microsoft guidance and reference architectures (such as Azure Landing Zone), which also perform remediation at subscription or child management group levels, not at the tenant root.

Reference: https://azure.github.io/azure-monitor-baseline-alerts/patterns/alz/HowTo/deploy/Remediate-Policies/

So, the DeployIfNotExists effect can be assigned at the tenant root management group, but remediation tasks are intentionally not supported at that scope because ARM deployments require a subscription or resource group context. Assignments at lower scopes are required to remediate existing resources.

Thanks,

Suchitra.

At the management group (including root) scope, the policy assignment wizard does not create remediation tasks inline. The “Create a remediation task” checkbox on the Remediation tab is only supported for policy assignments at subscription scope.

For deployIfNotExists or modify policies assigned at management group scope, the workflow is:

1. Assign the policy or initiative to the management group (the Remediation tab will show that remediation tasks are not supported during assignment).
2. Wait for policy evaluation to complete so that non-compliant resources are identified.
3. Create the remediation task separately using one of these options:
   • In the Azure portal:
     • Go to Policy → Remediation and use Option 1 or Option 2 from the article to create a remediation task for the non-compliant assignment at management group scope.
   • Or via PowerShell/CLI:
     • Use Start-AzPolicyRemediation (PowerShell) or az policy remediation create (CLI) and point -PolicyAssignmentId / --policy-assignment to the management group–scoped assignment.

This behavior is expected: the inline remediation checkbox is supported for subscription assignments, while management group assignments require creating remediation tasks after evaluation.

References:

• Remediate non-compliant resources with Azure Policy
• Create a remediation task
• Azure Policy remediation task structure
• Azure Policy glossary
• Remediation interface