While configuring an Azure policy in the Azure portal, you need to include an effect that requires a managed identity to be assigned. Which effect requires a managed identity?

The DeployIfNotExist effect requires a managed identity because it performs a deployment of resources or modifications to existing resources when a condition is met. This deployment action needs permissions to create or modify resources, and a managed identity provides the necessary authorization for the policy to execute these operations securely. AuditIfNotExist only audits compliance and does not perform any deployments, so it does not require a managed identity. Disabled simply deactivates the policy and has no operational impact. EnforceOPAConstraint is related to Open Policy Agent (OPA) constraints, which are typically evaluated by a separate enforcement mechanism and do not directly involve Azure resource deployments by the policy itself.