Azure Policy enforces governance and compliance by letting you write custom policy definitions as JSON documents. A policy definition contains a displayName, description, mode, and metadata that describe the rule and its context. The core of the definition is the policyRule, which uses field comparisons (via aliases that map to resource properties) or value comparisons, and can examine items inside arrays using array aliases. Each rule ends with an effect such as deny (block the change), audit (log the violation), or modify (apply a fix). You can also define parameters in the JSON so that the policy accepts values at assignment time, making the same policy reusable across different environments.
An initiative definition (also called a policy set) bundles multiple policy definitions into one JSON structure. The initiative includes properties.displayName, description, and metadata, plus an array of policyDefinitions that each reference a custom or built-in policy. Shared parameters at the initiative level let you pass a single value that applies to all included policies, which simplifies managing consistent standards across multiple subscriptions.
When you assign a policy or initiative, you choose the scope—a management group, subscription, resource group, or individual resource—and optionally set exclusions using the notScopes property to skip specific containers. The enforcementMode property controls behavior during assignment: Default applies the policy effect normally, DoNotEnforce audits without blocking or modifying resources, and Enroll prepares for future enforcement without applying the effect yet. This choice lets you test policies before fully enforcing them.
After assignment, Azure Policy evaluates resources and reports compliance results. You can view which resources are non-compliant and drill into the specific violations. To fix existing non-compliant resources, you create a remediation task using commands such as Start-AzPolicyRemediation –Name –PolicyAssignmentId . Remediation can add missing settings, deploy extensions, or register identities, automating the correction of resources that fail the policy’s conditions.
A process flow showing how an Azure Policy assignment evaluates resource compliance, applies effects like deny or audit, and triggers remediation tasks to correct non-compliant resources.
Are you a guardian of your domain? Lean how to leverage your aptitude in security to protect Microsoft Azure technologies, with a goal of earning the Microsoft Certified: Azure Security Engineer Associate certification!
Prepare and test your skills
Prepare and test your skills
A custom policy definition is a single JSON rule that enforces a specific condition with an effect like deny or audit, while an initiative definition (also called a policy set) bundles multiple policy definitions into one JSON structure to manage consistent standards.
The enforcement modes are Default, which applies the policy effect normally; DoNotEnforce, which audits without blocking or modifying resources; and Enroll, which prepares for future enforcement without applying the effect yet, allowing for testing.
You create a remediation task using commands like Start-AzPolicyRemediation, which automates the correction of resources by adding missing settings, deploying extensions, or registering identities.
StudyCerts
StudyCerts