Create an Azure Policy definition with DeployIfNotExists effect and trigger a remediation task

Steps

1. Author a policy definition JSON with `policyRule.then.effect: DeployIfNotExists` and a `details.deployment` block that contains the ARM template to deploy when the condition is not met.
2. Assign the policy at the desired scope (subscription or management group) using `az policy assignment create --policy <definition-id> --scope <scope> --assign-identity --location <region>`; the `--assign-identity` flag creates a managed identity for remediation.
3. Grant the managed identity the required RBAC role (e.g., Contributor) on the target scope so it can deploy the remediation ARM template.
4. Verify non-compliant resources in the Azure Portal under Policy > Compliance or via `az policy state list --policy-assignment <assignment-id> --filter "complianceState eq 'NonCompliant'"`.
5. Start a remediation task with `az policy remediation create --name <NAME> --policy-assignment <assignment-id> --resource-discovery-mode ReEvaluateCompliance`; `ReEvaluateCompliance` re-evaluates all resources before selecting targets.
6. Monitor remediation progress with `az policy remediation show --name <NAME>` until `provisioningState` reaches `Succeeded`.