You plan to assign policies that use DeployIfNotExist, AuditIfNotExist, Append, and Deny effects. Which policy effect requires a managed identity on the policy assignment?

The DeployIfNotExist policy effect requires a managed identity on the policy assignment. This is because DeployIfNotExist policies perform a deployment action, such as creating resources or modifying resource properties, when the evaluation condition is met. For the policy to execute these deployment operations, it needs a managed identity with the necessary permissions to interact with Azure resources. AuditIfNotExist and Append effects do not require a managed identity because they do not perform resource deployments. AuditIfNotExist simply logs non-compliance, and Append adds specified fields to a resource during creation or update. Deny prevents resource creation or modification and also does not require a managed identity.