Azure Policy for governance - Step-by-Step Execution

Process Flow - Azure Policy for governance

Define Policy Definition

↓

Assign Policy to Scope

↓

Evaluate Resources

↓

Enforce or Audit Compliance

↓

Report Compliance Results

Azure Policy starts with defining rules, then assigning them to resources, evaluating compliance, enforcing rules, and reporting results.

Execution Sample

Azure

az policy definition create --name 'allowed-locations' --rules @rules.json --mode All
az policy assignment create --name 'assign-allowed-locations' --policy 'allowed-locations' --scope '/subscriptions/12345'

This code creates a policy definition to restrict locations and assigns it to a subscription scope.

Process Table

Step	Action	Input	Evaluation	Result
1	Create Policy Definition	Rules JSON with allowed locations	Validates JSON syntax and rules	Policy definition created
2	Assign Policy	Policy name and scope	Checks scope validity	Policy assigned to subscription
3	Evaluate Resources	Existing resources in scope	Checks if resource locations are allowed	Non-compliant resources identified
4	Enforce or Audit	Policy effect (Deny/Audit)	Applies effect on resource creation/update	Creation denied or audit logged
5	Report Compliance	Compliance data collected	Aggregates compliance state	Compliance report generated
6	End	No further actions	N/A	Policy enforcement cycle complete

💡 Policy enforcement cycle completes after compliance reporting.

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	After Step 4	Final
Policy Definition	None	Created with rules	Assigned to scope	Used for evaluation	Effect applied	Stored for reporting
Scope	None	None	Subscription ID	Resources evaluated	Enforcement applied	Compliance reported
Compliance State	Unknown	Unknown	Unknown	Non-compliant resources found	Enforcement effect recorded	Final compliance status

Key Moments - 3 Insights

Why does the policy need to be assigned after creation?

Creating a policy only defines rules; assigning it to a scope activates it for resources in that scope, as shown in steps 1 and 2 of the execution_table.

What happens if a resource does not comply with the policy?

Step 4 shows that depending on the policy effect, the resource creation can be denied or just logged for audit, enforcing governance.

How is compliance reported?

Step 5 collects and aggregates compliance data from evaluated resources to generate a report, helping track governance status.

Visual Quiz - 3 Questions

Look at the execution_table, what is the result after Step 3 'Evaluate Resources'?

A Policy assigned to subscription

B Non-compliant resources identified

C Compliance report generated

D Policy definition created

💡 Hint

Check the 'Result' column for Step 3 in the execution_table.

At which step is the policy effect applied to resource creation or update?

A Step 2

B Step 3

C Step 4

D Step 5

💡 Hint

Look for 'Effect applied' or 'Enforcement applied' in the execution_table.

If the policy is not assigned to any scope, what will happen during evaluation?

A No resources will be evaluated

B Resources will be evaluated normally

C Policy definition will be deleted

D Compliance report will be generated anyway

💡 Hint

Refer to Step 2 and Step 3 in the execution_table about assignment and evaluation.

Concept Snapshot

Azure Policy governs resources by defining rules (policy definitions).
Policies must be assigned to a scope (subscription, resource group).
Azure evaluates resources against policies and enforces effects (deny, audit).
Compliance reports show which resources follow or break policies.
This helps keep cloud resources secure and compliant.

Full Transcript

Azure Policy for governance involves creating a policy definition with rules, assigning it to a scope such as a subscription, evaluating resources in that scope for compliance, enforcing the policy effects like denying non-compliant resource creation or auditing, and finally reporting compliance results. This cycle ensures cloud resources follow organizational rules and standards.

Practice

1. What is the main purpose of Azure Policy in cloud governance?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To enforce rules and ensure resources comply with organizational standards

D. To backup data to external storage

Solution

1. Step 1: Understand Azure Policy's role

   Azure Policy is designed to enforce rules on resources to keep them compliant with company rules.

2. Step 2: Compare options to this role

   Only To enforce rules and ensure resources comply with organizational standards describes enforcing rules and compliance, which matches Azure Policy's purpose.

3. Final Answer:

   To enforce rules and ensure resources comply with organizational standards -> Option C

4. Quick Check:

   Azure Policy = Enforce rules [OK]

Hint: Azure Policy controls rules, not resource creation [OK]

Common Mistakes:

• Confusing Azure Policy with Azure Monitor
• Thinking Azure Policy creates resources
• Mixing Azure Policy with backup services

2. Which JSON element is required to specify the action Azure Policy should take when a rule is violated?

easy

A. "effect"

B. "then"

C. "if"

D. "condition"

Solution

1. Step 1: Identify the JSON structure of Azure Policy

   Azure Policy uses "if" to define conditions and "then" to specify what happens, but the specific action is defined by "effect".

2. Step 2: Confirm the element that defines the action

   The "effect" element tells Azure Policy what to do, like deny or audit, when the condition is met.

3. Final Answer:

   "effect" -> Option A

4. Quick Check:

   Action in Azure Policy = effect [OK]

Hint: "effect" defines the action in Azure Policy JSON [OK]

Common Mistakes:

• Confusing "then" with the action element
• Using "condition" instead of "if"
• Missing the "effect" element entirely

3. Given this Azure Policy snippet, what will happen if a storage account is created without encryption enabled?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": false
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The storage account creation will be allowed without encryption

B. The storage account creation will be denied

C. The policy will audit the storage account but allow creation

D. The policy will ignore the encryption setting

Solution

1. Step 1: Analyze the condition in the policy

   The policy checks if encryption.enabled is false (not enabled).

2. Step 2: Understand the effect when condition matches

   The effect is "deny", so if encryption is false, creation is blocked.

3. Final Answer:

   The storage account creation will be denied -> Option B

4. Quick Check:

   Condition false + effect deny = block creation [OK]

Hint: "deny" effect blocks resource creation if condition true [OK]

Common Mistakes:

• Thinking "deny" allows creation but logs it
• Confusing "deny" with "audit" effect
• Ignoring the condition check on encryption

4. You wrote this Azure Policy but it does not block unencrypted storage accounts as expected. What is the error?

{
  "if": {
    "field": "Microsoft.Storage/storageAccounts/encryption.enabled",
    "equals": "false"
  },
  "then": {
    "effect": "deny"
  }
}

medium

A. The value "false" should be a boolean false, not a string

B. The "effect" should be "audit" instead of "deny"

C. The "field" name is incorrect for encryption

D. The policy is missing a "parameters" section

Solution

1. Step 1: Check the data type of the "equals" value

   The policy uses "equals": "false" which is a string, but encryption.enabled is a boolean.

2. Step 2: Correct the data type to boolean

   Changing "false" (string) to false (boolean) fixes the condition to match properly.

3. Final Answer:

   The value "false" should be a boolean false, not a string -> Option A

4. Quick Check:

   Boolean false, not string "false" fixes policy [OK]

Hint: Use boolean false, not string "false" in conditions [OK]

Common Mistakes:

• Using string "false" instead of boolean false
• Changing effect to audit instead of deny
• Assuming field name is wrong without checking

5. You want to create an Azure Policy that audits virtual machines which do not have a specific tag named "Environment". Which effect should you use to only report non-compliance without blocking resource creation?

hard

A. "deny"

B. "deployIfNotExists"

C. "append"

D. "audit"

Solution

1. Step 1: Understand the requirement to report but not block

   You want to find resources missing the tag but still allow creation.

2. Step 2: Identify the effect that audits without blocking

   The "audit" effect reports non-compliance but does not prevent resource creation.

3. Step 3: Compare other effects

   "deny" blocks creation, "append" adds properties, "deployIfNotExists" deploys resources, none just audit.

4. Final Answer:

   "audit" -> Option D

5. Quick Check:

   Audit effect reports without blocking [OK]

Hint: Use "audit" to report issues without blocking [OK]

Common Mistakes:

• Using "deny" which blocks resource creation
• Confusing "append" with audit
• Choosing "deployIfNotExists" which deploys resources