Add custom standards to Microsoft Defender for Cloud

Custom Policy Initiative Creation and Assignment

Azure Policy as Code Workflows

Managing security standards at scale requires treating compliance rules as software. Azure Policy as Code is a workflow that integrates Infrastructure as Code (IaC) and DevOps practices to manage security rules across an entire enterprise. By storing Azure Policy definitions in source control, security teams can track history, collaborate on changes, and automatically deploy updates. These definitions are written as JSON files and are grouped into an initiative definition, which is a collection of related policies designed to meet a specific security goal.

Creating Policies and Initiative Definitions

The creation process begins by writing individual policy definitions as JSON files that define the exact security rules, parameters, and target environments. These files are organized within a structured folder system in a source control repository like GitHub or Azure DevOps. Once the individual policies are established, developers create initiative definitions, which also use JSON files to reference and group the existing policies. An initiative cannot be created without referencing valid, existing policy definitions, establishing a clear dependency between the two resources.

The Policy Lifecycle and Workflow

The lifecycle of a custom security standard follows three distinct phases: create, test, and deploy. During the creation phase, developers author the JSON policy and initiative files and check them into source control. Next, in the testing phase, the initiative is deployed to a test environment with its enforcement state set to disabled. Finally, during the deployment phase, the active policy is pushed to production with enforcement turned on to block non-compliant resources or trigger automatic remediations.

Testing, Validation, and Deployment

To avoid disrupting active business operations, security teams must always validate new standards in a separate development environment first. Setting the enforcementMode property to disabled allows the policy to audit existing resources and report on compliance without blocking deployment activities. To automate this journey from code to cloud, teams use a centralized deployment mechanism like GitHub Actions or Azure Pipelines. These tools automatically run tests and apply the policy changes to the targeted scopes when updates are pushed to the main code repository.

Compliance Assessment and Scope Assignment

Once an initiative is validated, it is assigned to a specific target scope, such as an Azure subscription or a broader management group. Administrators can use Azure PowerShell, the Azure CLI, or Azure Resource Graph queries to automate these assignments and query resources. After assignment, the policies continuously evaluate the environment, feeding real-time compliance scores and required remediation tasks directly into the Microsoft Defender for Cloud dashboard. This centralized view allows security administrators to quickly identify failing resources, track their overall security posture, and trigger remediation workflows to correct misconfigurations.