Why Policies Matter

In large Azure environments, it’s not enough to trust administrators to follow best practices. You need enforcement.
Azure Policy helps you define rules that control what resources can be created and how they must be configured.

Think of Azure Policy as the rules of the game — it ensures every new resource complies with your governance standards.

Core Concepts

1. Azure Policy

• Defines individual rules such as:

  • “All storage accounts must have encryption enabled.”

  • “Only specific VM sizes can be deployed.”

  • “Resources must include the Department tag.”

• Policies are continuously evaluated, not just at creation.

2. Policy Assignments

• Scope: Management Group → Subscription → Resource Group → Resource.

• Policies assigned at higher levels cascade down.

3. Policy Effects

• Deny → Prevent non-compliant resource creation.

• Audit → Allow resource but mark as non-compliant.

• Append → Add extra settings (e.g., enforce tags).

• DeployIfNotExists → Automatically configure missing settings.

4. Policy Initiatives (Policy Sets)

• Collection of related policies bundled together.

• Example: “ISO 27001 Compliance Initiative” → applies multiple rules covering encryption, network security, identity, etc.

Example Enterprise Scenario

A healthcare company must ensure:

• All resources have an “Owner” tag.

• Storage accounts are encrypted with customer-managed keys.

• Only approved VM SKUs are deployed.

Solution:

• Assign Azure Policy at management group level.

• Use a Policy Initiative aligned with ISO 27001 or HIPAA compliance.

• Combine with DeployIfNotExists to enforce configuration automatically.

Confusion Buster

• Policy vs RBAC

  • RBAC controls who can do what.

  • Policy controls what can/cannot be deployed.

• Policy vs Blueprint (Landing Zone)

  • Policy = enforcement mechanism.

  • Blueprint = package that can include policies, role assignments, ARM templates.

Best Practices for Policy Design

• Assign policies at the highest possible scope (management group or subscription) for consistency.

• Use initiatives instead of hundreds of individual policies — easier to manage.

• Always test policies in Audit mode first before moving to Deny.

• Tagging policies help with cost management and compliance tracking.

Exam Tips

• “Prevent developers from creating expensive VMs” → Policy with Deny effect.

• “Ensure all resources include department tags” → Policy with Append effect.

• “Automatically configure diagnostics if missing” → Policy with DeployIfNotExists.

• “Bundle multiple compliance requirements” → Policy Initiative.

What to Expect in the Exam

• Direct Q: “Which feature enforces resource compliance in Azure?” → Azure Policy.

• Scenario Q: “Company requires all resources to include an ‘Owner’ tag and enforce encryption.” → Policy Initiative.

• Trick Q: “Azure Policy only checks at resource creation.” → False (it checks continuously).