Azure Policy

What it is

Azure Policy is a governance service that creates, assigns, and enforces rules for Azure resources to ensure they stay compliant — e.g. “only allow VMs in approved regions” or “require tagging.” It evaluates existing resources and governs new deployments.

Why it exists

People make mistakes. Policy lets an org codify governance so non-compliant resources are automatically flagged (and optionally prevented/denied) at scale across subscriptions — regardless of who creates them.

Key ideas

• Defined vs assigned — policy definitions are written once (built-in or custom); an assignment applies them to a scope and enforces.
• Initiative — a group of policy definitions treated as one unit for enforcement/reporting (e.g. regulatory compliance initiatives).
• Effects — Audit, Deny, DeployIfNotExists (+ Modify for remediation), etc. Deny blocks non-compliant creation.
• Exemptions/exclusions — carve out specific resources/subgroups.
• Not RBAC — Policy enforces rules; RBAC controls permissions. You can have both. Policy also doesn’t limit compute/identity permission — it limits configuration.

How it fits (diagram)

Diagrams courtesy of Microsoft Learn / Azure docs: azure-policy/overview

Exam notes

• Distinguish Azure Policy (rules/compliance) from RBAC (access): a classic AZ-104 contrast.
• Know how to assign a built-in policy or initiative and read compliance state.
• Deny vs Audit effect mental model is heavily tested.

Related

management-groups · scope · rbac · resource-tags

📘 Source: Microsoft Learn — Azure Policy