Why Governance Matters

Even with security tools in place, admins must enforce compliance.
Azure provides Policies and Blueprints to make sure resources follow organizational rules.

Azure Policy

• A service to create, assign, and enforce rules (policies).

• Ensures resources are compliant with security and governance standards.

• Evaluates resources at creation and continuously.

Examples:

• Enforce that all storage accounts must use HTTPS.

• Deny creating resources in regions outside the company’s compliance scope.

• Require VMs to use specific SKUs or have tags applied.

Effects of Policies:

• Deny → prevent non-compliant resources.

• Audit → allow creation but log it.

• DeployIfNotExists → automatically deploy required configurations.

• Append → add settings (like tags) to resources.

Azure Blueprints

• Package multiple governance artifacts (Policies, Role Assignments, Resource Groups, ARM templates).

• Used for standardized deployments across subscriptions.

• Great for setting up compliance at scale.

Example:

• Deploy a “Finance Subscription Blueprint” → includes security policies, specific RBAC roles, and resource group structure.

Confusion Buster 🚨

• Policy vs RBAC

  • Policy = what you can deploy/configure.

  • RBAC = what you can do/access.

• Policy vs Blueprint

  • Policy = single rule.

  • Blueprint = bundle of multiple rules + resources.

Exam trap: If requirement is “enforce rules on resources” → Policy. If it says “deploy predefined governance package” → Blueprint.

Simple Example

A company wants:

• Every resource to have an “Environment” tag.

• Only specific VM SKUs to be used.

• To replicate this governance setup across all new subscriptions.

Solution:

• Apply Azure Policies to enforce tags and SKU rules.

• Create a Blueprint to roll out the whole setup consistently.

Exam Tip

• Policy = enforce compliance.

• Blueprint = deploy compliance at scale.

• If scenario mentions Deny non-compliant resources, answer is Policy.

• If scenario mentions package governance for subscriptions, answer is Blueprint.

What to Expect in the Exam

• Direct Q: “Which service enforces HTTPS-only for storage accounts?” → Azure Policy.

• Scenario: “Company wants to ensure all new subscriptions follow the same governance template.” → Blueprint.

• Trick Q: “RBAC can enforce tagging rules on resources.” (False — that’s Policy).