Enforcing Allowed Locations with Azure Policy

What Azure Policy and Built-In Definitions Are

Azure Policy is a dedicated governance service in Microsoft Azure that allows organizations to define, assess, and enforce corporate standards and regulatory compliance across their cloud environments. Azure Policy compares resource configurations against defined business logic. To accelerate governance, Azure provides built-in policy definitions—pre-configured rules created by Microsoft that address standard use cases such as enforcing naming conventions, requiring resource tags, or restricting deployments to allowed geographic locations.

How It Meets the Requirement

• Pre-configured rules: Azure includes a built-in policy definition named Allowed locations that enables administrators to select permitted regions from a list of parameters without writing custom JSON definitions.
• Scope-level enforcement: Policy definitions can be assigned to various Resource Manager scopes, including management groups, subscriptions, resource groups, or individual resources. Assigning the policy at the subscription scope automatically applies the rule to all current and future deployments within that entire subscription.
• Preventive enforcement: By setting the policy effect to Deny, Azure Resource Manager blocks any deployment request targeting an unapproved region during resource creation or update.

Key Advantages and Capabilities

• Zero custom code required: Pre-built policy templates eliminate the need to write and validate complex JSON schemas manually.
• Scalable governance: Policies inherit down through the resource hierarchy, applying uniformly across all resource groups under the assigned subscription.
• Real-time evaluation: Evaluates requests immediately when resources are created or updated, preventing non-compliant deployments before they occur.
• Centralized visibility: Provides a compliance dashboard displaying overall organizational compliance status.

Why This Is Optimal

Assigning a built-in policy is the native, intended method for enforcing cloud governance and resource configurations at scale across Azure scopes.