An organization wants to establish cloud governance and security best practices across all of its Azure workloads. The IT security team needs to automatically prevent the deployment of non-compliant resources, audit existing resources against security baselines, and continuously assess compliance with organizational standards. Which Azure service or feature should the organization use to enforce these configuration rules?

Azure Policy: ### What Azure Policy Is **Azure Policy** is a dedicated governance and compliance management service in Azure. It enables organizations to create, assign, and manage policies that define rules and effects for resource properties and configurations across subscriptions and management groups. ### How It Meets the Requirements Azure Policy directly addresses all the stated governance and security needs: - **Preventing non-compliant deployments**: Policies can use the `Deny` effect to automatically block resource creation or modification requests that violate established organizational standards (e.g., preventing public IP creation or unencrypted storage accounts). - **Auditing configurations**: Policies evaluate existing workloads using the `Audit` effect to report resources that deviate from security baselines without disrupting active operations. - **Continuous compliance assessment**: It continuously scans resources to verify alignment with corporate standards and regulatory compliance frameworks. ### Key Advantages and Capabilities - **Proactive governance guardrails**: Enforces organizational standards across cloud deployments at scale before resources are provisioned. - **Automated remediation**: Can use effects like `DeployIfNotExists` or `Modify` to remediate non-compliant configurations automatically. - **Broad scope management**: Applies rules at management group, subscription, or resource group levels. - **Integration with security benchmarks**: Works natively with Microsoft Cloud Security Benchmark definitions to assess overall security posture. ### Why This Is Optimal Azure Policy is the native, built-in governance engine designed specifically for configuration enforcement, compliance reporting, and automated policy guardrails across cloud assets.