Bird
Raised Fist0
Azurecloud~5 mins

Azure Policy for governance - Commands & Configuration

Choose your learning style10 modes available
LearnWhyDeepVisualTryChallengeProjectRecallTime
Introduction
Azure Policy helps you set rules for your cloud resources so they follow your company's rules. It stops mistakes and keeps your cloud safe and organized.
When you want to make sure all virtual machines use approved sizes only.
When you need to block creation of resources in certain locations to control costs.
When you want to enforce tagging on all resources for easy tracking.
When you want to audit if any storage accounts allow public access.
When you want to automatically apply security settings to new resources.
Config File - policy-definition.json
policy-definition.json
{
  "properties": {
    "displayName": "Allowed VM sizes",
    "policyType": "Custom",
    "mode": "All",
    "description": "This policy limits the VM sizes that can be deployed.",
    "parameters": {
      "listOfAllowedSizes": {
        "type": "Array",
        "metadata": {
          "description": "The list of allowed VM sizes.",
          "displayName": "Allowed VM sizes",
          "strongType": "VMSizes"
        }
      }
    },
    "policyRule": {
      "if": {
        "field": "Microsoft.Compute/virtualMachines/sku.name",
        "notIn": "[parameters('listOfAllowedSizes')]"
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}

This JSON file defines a policy that restricts virtual machine sizes to a specific list.

properties.displayName: The name shown in Azure Policy.

properties.parameters.listOfAllowedSizes: The VM sizes allowed.

properties.policyRule: The rule that denies VM creation if size is not allowed.

Commands
This command creates a new Azure Policy definition named 'AllowedVMSizes' using the rules in the JSON file. It sets the policy to apply to all resource types.
Terminal
az policy definition create --name AllowedVMSizes --display-name "Allowed VM sizes" --description "Limit VM sizes to approved list" --rules policy-definition.json --mode All
Expected OutputExpected
{ "id": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policyDefinitions/AllowedVMSizes", "name": "AllowedVMSizes", "properties": { "displayName": "Allowed VM sizes", "description": "Limit VM sizes to approved list", "metadata": {}, "mode": "All", "policyRule": { "if": { "field": "Microsoft.Compute/virtualMachines/sku.name", "notIn": ["Standard_DS1_v2", "Standard_DS2_v2"] }, "then": { "effect": "deny" } }, "parameters": { "listOfAllowedSizes": { "type": "Array", "metadata": { "description": "The list of allowed VM sizes.", "displayName": "Allowed VM sizes", "strongType": "VMSizes" } } } }, "type": "Microsoft.Authorization/policyDefinitions" }
→
--name - Sets the unique name for the policy definition.
→
--rules - Specifies the JSON file with the policy rules.
→
--mode - Defines which resource types the policy applies to.
This command assigns the 'AllowedVMSizes' policy to a specific resource group named 'example-rg' and sets the allowed VM sizes to two specific types.
Terminal
az policy assignment create --name EnforceAllowedVMSizes --policy AllowedVMSizes --params '{"listOfAllowedSizes":{"value":["Standard_DS1_v2","Standard_DS2_v2"]}}' --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg
Expected OutputExpected
{ "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg/providers/Microsoft.Authorization/policyAssignments/EnforceAllowedVMSizes", "name": "EnforceAllowedVMSizes", "properties": { "displayName": "Allowed VM sizes", "policyDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policyDefinitions/AllowedVMSizes", "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/example-rg", "parameters": { "listOfAllowedSizes": { "value": [ "Standard_DS1_v2", "Standard_DS2_v2" ] } }, "enforcementMode": "Default" }, "type": "Microsoft.Authorization/policyAssignments" }
→
--policy - Specifies which policy definition to assign.
→
--params - Sets the parameters for the policy assignment.
→
--scope - Defines where the policy applies, here a resource group.
This command checks the compliance state of resources under the 'EnforceAllowedVMSizes' policy assignment to see if any resources violate the policy.
Terminal
az policy state list --query "[?policyAssignmentName=='EnforceAllowedVMSizes']"
Expected OutputExpected
[]
→
--query - Filters the output to show only states related to the specific policy assignment.
Key Concept

If you remember nothing else from this pattern, remember: Azure Policy lets you set rules that automatically check and enforce how your cloud resources are created and used.

Common Mistakes
Not specifying the correct scope when assigning the policy.
The policy won't apply where you expect, so resources can be created without restrictions.
Always use the correct subscription or resource group ID in the --scope flag.
Using an incorrect JSON format in the policy definition file.
Azure will reject the policy creation with an error.
Validate your JSON syntax and structure before creating the policy.
Not providing required parameters when assigning a policy that needs them.
The policy assignment will fail or not enforce the intended rules.
Always pass parameters using the --params flag in correct JSON format.
Summary
Create a policy definition JSON file that sets the rules for resource compliance.
Use 'az policy definition create' to register the policy in Azure.
Assign the policy to a scope like a resource group with 'az policy assignment create' and set parameters.
Check compliance status with 'az policy state list' to see if resources follow the rules.

Practice

(1/5)
1. What is the main purpose of Azure Policy in cloud governance?
easy
A. To monitor network traffic in real-time
B. To create virtual machines automatically
C. To enforce rules and ensure resources comply with organizational standards
D. To backup data to external storage

Solution

  1. Step 1: Understand Azure Policy's role

    Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

  2. Step 2: Compare options to this role

    Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

  3. Final Answer:

    To enforce rules and ensure resources comply with organizational standards -> Option C

  4. Quick Check:

    Azure Policy = Enforce rules [OK]
Hint: Azure Policy controls rules, not resource creation [OK]
Common Mistakes:
  • Confusing Azure Policy with Azure Monitor
  • Thinking Azure Policy creates resources
  • Mixing Azure Policy with backup services
2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?
easy
A. "effect"
B. "then"
C. "if"
D. "condition"

Solution

  1. Step 1: Identify the JSON structure of Azure Policy

    Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

  2. Step 2: Confirm the element that defines the action

    The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

  3. Final Answer:

    "effect" -> Option A

  4. Quick Check:

    Action in Azure Policy = effect [OK]
Hint: "effect" defines the action in Azure Policy JSON [OK]
Common Mistakes:
  • Confusing "then" with the action element
  • Using "condition" instead of "if"
  • Missing the "effect" element entirely
3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled? 
{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}
medium
A. The storage account creation will be allowed without encryption
B. The storage account creation will be denied
C. The policy will audit the storage account but allow creation
D. The policy will ignore the encryption setting

Solution

  1. Step 1: Analyze the condition in the policy

    The policy checks if encryption.enabled is false (not enabled).

  2. Step 2: Understand the effect when condition matches

    The effect is "deny", so if encryption is false, creation is blocked.

  3. Final Answer:

    The storage account creation will be denied -> Option B

  4. Quick Check:

    Condition false + effect deny = block creation [OK]
Hint: "deny" effect blocks resource creation if condition true [OK]
Common Mistakes:
  • Thinking "deny" allows creation but logs it
  • Confusing "deny" with "audit" effect
  • Ignoring the condition check on encryption
4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error? 
{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}
medium
A. The value "false" should be a boolean false, not a string
B. The "effect" should be "audit" instead of "deny"
C. The "field" name is incorrect for encryption
D. The policy is missing a "parameters" section

Solution

  1. Step 1: Check the data type of the "equals" value

    The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

  2. Step 2: Correct the data type to boolean

    Changing "false" (string) to false (boolean) fixes the condition to match properly.

  3. Final Answer:

    The value "false" should be a boolean false, not a string -> Option A

  4. Quick Check:

    Boolean false, not string "false" fixes policy [OK]
Hint: Use boolean false, not string "false" in conditions [OK]
Common Mistakes:
  • Using string "false" instead of boolean false
  • Changing effect to audit instead of deny
  • Assuming field name is wrong without checking
5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?
hard
A. "deny"
B. "deployIfNotExists"
C. "append"
D. "audit"

Solution

  1. Step 1: Understand the requirement to report but not block

    You want to find resources missing the tag but still allow creation.

  2. Step 2: Identify the effect that audits without blocking

    The "audit" effect reports non-compliance but does not prevent resource creation.

  3. Step 3: Compare other effects

    "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

  4. Final Answer:

    "audit" -> Option D

  5. Quick Check:

    Audit effect reports without blocking [OK]
Hint: Use "audit" to report issues without blocking [OK]
Common Mistakes:
  • Using "deny" which blocks resource creation
  • Confusing "append" with audit
  • Choosing "deployIfNotExists" which deploys resources
Recommended

Ready to prove it?

Pass the test and this pattern moves unknown strong while earning +1 Grip toward your certificate.

10 questions~5 mineasy hard