Azure Policy is a service that helps organizations enforce standards and check compliance across their Azure resources. It lets administrators create rules that resources must follow, such as requiring encryption or restricting where certain types of resources can be created. When resources are deployed, Azure Policy evaluates them against the defined rules and reports whether they comply. This evaluation happens automatically, so teams can see compliance status without manual checking.
Azure Policy includes both built-in and custom policy definitions. Built-in policies are pre-made by Microsoft and address common needs like requiring HTTPS for web apps or enforcing tags on resources. Custom policies are created by organizations to meet specific requirements that built-in policies do not cover. Both types work the same way in the system—they define conditions that resources must meet. Policies can control access management by ensuring only authorized identities can deploy resources, enforce specific configurations like requiring certain VM sizes, and implement security measures such as blocking public IP addresses on storage accounts.
Policy initiatives group related policies together to address broader compliance goals. Instead of assigning many individual policies, administrators can assign one initiative that contains multiple policies working toward a common objective. For example, an initiative for regulatory compliance might include policies for encryption, logging, and access controls all at once. Initiatives can be applied at subscription level, resource group level, or across multiple management groups for organization-wide governance. Common built-in initiatives include the CIS Microsoft Azure Foundations Benchmark and FedRAMP High, which provide pre-defined sets of controls for specific regulatory frameworks.
When a policy or initiative is assigned to a scope, it begins enforcing rules for all resources within that scope. Administrators can set parameters when assigning policies to customize how they apply without changing the policy definition itself. For instance, a policy that requires tagging could have a parameter specifying which tag name is required. Scopes work in a hierarchy: management groups contain subscriptions, subscriptions contain resource groups, and resource groups contain resources. Policies assigned at a higher scope apply to everything beneath it, though lower assignments can create exceptions for specific needs.
A vertical hierarchy from Management Group down to Subscription, Resource Group, and Resource, with a side note explaining that policy assignments inherit downward to all child scopes.
Azure Policy collects compliance data from all assigned policies and shows the overall compliance state through the Azure Portal, CLI, or Azure Resource Graph. The compliance dashboard displays which resources pass and which fail, along with the specific policy each resource violates. When resources are non-compliant, administrators can configure remediation tasks to fix the issue. Remediation can be automatic, where Azure Policy deploys the required configuration, or manual, where administrators receive alerts and make changes themselves. Azure Monitor Logs can be used to create alerts when compliance issues arise, enabling proactive management.
Implementing Azure Policy initiatives provides continuous compliance by automatically evaluating resources as they are deployed and on a schedule afterward. This prevents "configuration drift," where resources slowly diverge from standards over time. The system also generates audit-ready documentation that shows exactly what controls are in place and which resources meet them. Organizations save time by automating enforcement rather than relying on manual reviews, and they can scale governance consistently as their Azure environment grows.
Venture into the world of Azure Infrastructure, where design meets functionality. Harness your skills and gain mastery over complex cloud structures to ace the AZ-305 Designing Microsoft Azure Infrastructure Solutions exam!
Prepare and test your skills
Prepare and test your skills
A policy definition sets individual rules and conditions that Azure resources must follow, whereas a policy initiative groups multiple related policies together to address broader compliance goals. Assigning an initiative allows administrators to manage and apply a collection of policies toward a common objective in a single assignment.
Policies and initiatives assigned at a higher scope apply to all resources beneath that level in the hierarchy, which flows from management groups down to subscriptions, resource groups, and individual resources. While high-level assignments enforce governance across all child containers, lower assignments can establish exceptions for specific needs.
Azure Policy resolves non-compliant resources using remediation tasks that can execute automatically or manually. In automatic remediation, Azure Policy deploys the required configuration to fix the issue, whereas manual remediation alerts administrators so they can apply the necessary changes.
StudyCerts
StudyCerts