Policy assignments and compliance in Azure - Commands & Configuration

Introduction

Azure Policy helps you make sure your cloud resources follow rules you set. Policy assignments apply these rules to groups of resources. Compliance shows if your resources follow the rules or not.

When you want to make sure all virtual machines use approved sizes to save costs.

When you need to block creation of storage accounts without encryption for security.

When you want to check if all resources have tags for billing and management.

When you want to enforce that only certain regions are used for resource deployment.

When you want to get reports on how well your resources follow company policies.

Commands

This command assigns a policy named 'enforce-vm-size' that restricts virtual machine sizes to allowed options within the 'myResourceGroup' resource group.

Terminal

az policy assignment create --name enforce-vm-size --policy "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policyDefinitions/allowed-vm-sizes" --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup"

Expected Output

{

  "id": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Authorization/policyAssignments/enforce-vm-size",

  "name": "enforce-vm-size",

  "properties": {

    "displayName": "enforce-vm-size",

    "policyDefinitionId": "/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Authorization/policyDefinitions/allowed-vm-sizes",

    "scope": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup"

  },

  "type": "Microsoft.Authorization/policyAssignments"

}

→

--name - Sets the name of the policy assignment.

→

--policy - Specifies the policy definition to assign.

→

--scope - Defines where the policy applies, here a resource group.

This command shows a summary of compliance states for all policy assignments under the 'myManagementGroup' management group.

Terminal

az policy state summarize --management-group myManagementGroup

Expected Output

{

  "results": [

    {

      "policyAssignmentName": "enforce-vm-size",

      "compliantResources": 5,

      "nonCompliantResources": 2

    }

  ]

}

→

--management-group - Specifies the management group to check compliance for.

This command lists the top 3 resources that are not compliant with assigned policies, helping you find issues quickly.

Terminal

az policy state list --filter "IsCompliant eq false" --top 3

Expected Output

[

  {

    "resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/vm1",

    "policyAssignmentName": "enforce-vm-size",

    "complianceState": "NonCompliant"

  },

  {

    "resourceId": "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/myResourceGroup/providers/Microsoft.Compute/virtualMachines/vm2",

    "policyAssignmentName": "enforce-vm-size",

    "complianceState": "NonCompliant"

  }

]

→

--filter - Filters results to show only non-compliant resources.

→

--top - Limits the number of results returned.

Key Concept

If you remember nothing else from this pattern, remember: policy assignments apply rules to resources, and compliance shows if those rules are followed.

Common Mistakes

Using the wrong scope when assigning a policy, like assigning to a subscription but expecting it to apply only to a resource group.

The policy applies to the entire subscription, affecting more resources than intended.

Specify the exact scope, such as a resource group, using the --scope flag.

Not checking compliance after assigning a policy.

You won't know if resources are following the policy or if action is needed.

Run compliance commands like 'az policy state summarize' to monitor policy effects.

Filtering compliance results incorrectly, causing no resources to show up.

Using wrong filter syntax or values returns empty results.

Use correct OData filter syntax, e.g., "IsCompliant eq false".

Summary

Assign policies to specific scopes to enforce rules on Azure resources.

Use compliance commands to check which resources follow or break the policies.

Filter compliance results to quickly find and fix non-compliant resources.

Practice

1. What is the main purpose of a policy assignment in Azure?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To apply rules to cloud resources to control their behavior

D. To backup data to external storage

Solution

1. Step 1: Understand policy assignment role and compare options

   Policy assignments are used to enforce rules or standards on Azure resources. Only To apply rules to cloud resources to control their behavior describes applying rules to control resource behavior, which matches policy assignments.

2. Final Answer:

   To apply rules to cloud resources to control their behavior -> Option C

3. Quick Check:

   Policy assignment = apply rules [OK]

Hint: Policies control resources by applying rules [OK]

Common Mistakes:

• Confusing policy assignments with resource creation
• Thinking policies monitor traffic or backup data
• Mixing policy assignments with alerts or logs

2. Which of the following is the correct way to assign a policy to a resource group using Azure CLI?

easy

A. az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId}

B. az policy create --name MyPolicy --resource-group {rgName} --policy {policyDefinitionId}

C. az group policy assign --name MyPolicy --resource-group {rgName} --definition {policyDefinitionId}

D. az policy assign --name MyPolicy --scope {rgName} --definition {policyDefinitionId}

Solution

1. Step 1: Recall Azure CLI syntax for policy assignment and validate options

   The correct command uses 'az policy assignment create' with --name, --scope, and --policy parameters. az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} matches the correct syntax. Others use incorrect commands or parameters.

2. Final Answer:

   az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} -> Option A

3. Quick Check:

   Correct CLI syntax = az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} [OK]

Hint: Use 'az policy assignment create' with --scope for resource group [OK]

Common Mistakes:

• Using 'az policy create' instead of 'az policy assignment create'
• Confusing resource group with scope format
• Using wrong parameter names like --definition

3. Given this Azure Policy assignment compliance result:
{"complianceState": "NonCompliant", "resourceId": "/subscriptions/123/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1"}
What does this indicate?

medium

A. The compliance state is unknown for vm1

B. The virtual machine vm1 follows the assigned policy rules

C. The policy assignment failed to apply to vm1

D. The virtual machine vm1 does not follow the assigned policy rules

Solution

1. Step 1: Interpret complianceState value and match to meaning

   The value 'NonCompliant' means the resource does not meet the policy requirements. Since vm1 is NonCompliant, it does not follow the assigned policy rules.

2. Final Answer:

   The virtual machine vm1 does not follow the assigned policy rules -> Option D

3. Quick Check:

   NonCompliant means policy not followed [OK]

Hint: NonCompliant means resource breaks policy rules [OK]

Common Mistakes:

• Assuming NonCompliant means policy applied successfully
• Confusing NonCompliant with Unknown or Compliant
• Thinking complianceState shows assignment failure

4. You assigned a policy to a subscription but the compliance report shows no data. What is the most likely cause?

medium

A. The resources are not evaluated yet or policy evaluation is delayed

B. The policy definition is missing required parameters

C. The policy assignment scope is incorrect or too broad

D. The policy assignment was created with the wrong Azure CLI command

Solution

1. Step 1: Understand policy evaluation timing and eliminate other causes

   Policy compliance data can take time to appear after assignment due to evaluation delays. Incorrect scope or missing parameters usually cause errors, not empty compliance. Wrong CLI command would fail assignment.

2. Final Answer:

   The resources are not evaluated yet or policy evaluation is delayed -> Option A

3. Quick Check:

   Compliance delay causes no data [OK]

Hint: Wait for policy evaluation to update compliance data [OK]

Common Mistakes:

• Assuming wrong CLI command always causes no data
• Thinking missing parameters prevent compliance data
• Ignoring evaluation delay after assignment

5. You want to enforce a policy that requires all storage accounts to have secure transfer enabled. You assign this policy at the subscription level with a parameter to exclude a specific resource group. What will happen to storage accounts in that excluded resource group?

hard

A. They will be evaluated but allowed to be non-compliant

B. They will not be evaluated or enforced by the policy

C. They will be forced to enable secure transfer regardless of exclusion

D. The policy assignment will fail due to conflicting parameters

Solution

1. Step 1: Understand policy exclusion parameter effect and confirm behavior on excluded resources

   Excluding a resource group means resources there are not evaluated or enforced by the policy. Excluded storage accounts are ignored by the policy, so no enforcement or compliance checks occur.

2. Final Answer:

   They will not be evaluated or enforced by the policy -> Option B

3. Quick Check:

   Exclusion skips evaluation and enforcement [OK]

Hint: Exclusions skip policy evaluation and enforcement [OK]

Common Mistakes:

• Thinking excluded resources are still checked but allowed
• Assuming policy forces compliance despite exclusions
• Believing exclusions cause assignment failure