Policy assignments and compliance in Azure - Step-by-Step Execution

Process Flow - Policy assignments and compliance

Define Policy Definition

↓

Assign Policy to Scope

↓

Evaluate Resources in Scope

↓

Check Compliance State

↓

Report Compliance Results

↓

Remediate Non-compliant Resources

This flow shows how a policy is defined, assigned to a scope, evaluated on resources, and compliance results are reported and remediated.

Execution Sample

Azure

az policy assignment create --name 'enforce-tag' --policy 'tag-policy' --scope '/subscriptions/1234'
az policy state list --assignment 'enforce-tag'

Assign a policy to a subscription scope and then check compliance state of resources under that assignment.

Process Table

Step	Action	Input	Output	Notes
1	Define Policy	Policy rule requiring 'environment' tag	Policy definition created	Policy specifies required tag on resources
2	Assign Policy	Assign 'tag-policy' to subscription '/subscriptions/1234'	Policy assignment created	Assignment links policy to scope
3	Evaluate Resources	Resources under subscription evaluated	Compliance states generated	Each resource checked for tag presence
4	Check Compliance	Compliance states collected	List of compliant and non-compliant resources	Non-compliant resources lack required tag
5	Report Results	Compliance list	Compliance report available	Report shows compliance summary
6	Remediate	Non-compliant resources identified	Remediation tasks triggered or manual fix	Fixes bring resources into compliance
7	End	All resources compliant or remediated	Policy enforcement complete	Process stops when compliance achieved

💡 All resources evaluated and compliance status reported; remediation ensures policy adherence.

Status Tracker

Variable	Start	After Step 2	After Step 4	After Step 6	Final
Policy Definition	None	Created with tag rule	Same	Same	Same
Policy Assignment	None	Created for subscription	Same	Same	Same
Resource Compliance States	None	None	Generated for all resources	Updated after remediation	All compliant
Compliance Report	None	None	Generated	Updated	Final report available

Key Moments - 3 Insights

Why do we assign a policy after defining it?

Defining a policy creates the rule, but assigning it to a scope tells Azure where to enforce it, as shown in steps 1 and 2 of the execution_table.

What happens if a resource is non-compliant?

Non-compliant resources are identified during evaluation (step 3) and remediation is triggered (step 6) to fix them and meet policy requirements.

Does compliance check happen automatically after assignment?

Yes, after assignment (step 2), Azure evaluates resources automatically (step 3) to determine compliance status.

Visual Quiz - 3 Questions

Look at the execution_table, at which step are resources evaluated for compliance?

A Step 4

B Step 2

C Step 3

D Step 5

💡 Hint

Check the 'Action' column for 'Evaluate Resources' in the execution_table.

According to variable_tracker, when are compliance states first generated?

A After Step 2

B After Step 4

C After Step 6

D At Start

💡 Hint

Look at 'Resource Compliance States' variable changes in variable_tracker.

If a policy assignment is missing, what will happen to compliance evaluation?

A No evaluation occurs

B Resources will be evaluated anyway

C Only some resources evaluated

D Evaluation is delayed

💡 Hint

Refer to execution_table steps 1 and 2 about assignment before evaluation.

Concept Snapshot

Policy assignments link policy definitions to scopes (subscriptions, resource groups).
Azure evaluates resources in the scope against the policy.
Compliance states show if resources meet policy rules.
Non-compliant resources can be remediated.
Policy enforcement ensures governance and standards.

Full Transcript

In Azure, you first create a policy definition that describes rules like requiring tags. Then you assign this policy to a scope such as a subscription. Azure evaluates all resources in that scope to check if they follow the policy. The compliance state for each resource is recorded. Reports show which resources are compliant or not. If resources are non-compliant, remediation can fix them to meet the policy. This process helps keep your cloud environment organized and secure.

Practice

1. What is the main purpose of a policy assignment in Azure?

easy

A. To monitor network traffic in real-time

B. To create virtual machines automatically

C. To apply rules to cloud resources to control their behavior

D. To backup data to external storage

Solution

1. Step 1: Understand policy assignment role and compare options

   Policy assignments are used to enforce rules or standards on Azure resources. Only To apply rules to cloud resources to control their behavior describes applying rules to control resource behavior, which matches policy assignments.

2. Final Answer:

   To apply rules to cloud resources to control their behavior -> Option C

3. Quick Check:

   Policy assignment = apply rules [OK]

Hint: Policies control resources by applying rules [OK]

Common Mistakes:

• Confusing policy assignments with resource creation
• Thinking policies monitor traffic or backup data
• Mixing policy assignments with alerts or logs

2. Which of the following is the correct way to assign a policy to a resource group using Azure CLI?

easy

A. az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId}

B. az policy create --name MyPolicy --resource-group {rgName} --policy {policyDefinitionId}

C. az group policy assign --name MyPolicy --resource-group {rgName} --definition {policyDefinitionId}

D. az policy assign --name MyPolicy --scope {rgName} --definition {policyDefinitionId}

Solution

1. Step 1: Recall Azure CLI syntax for policy assignment and validate options

   The correct command uses 'az policy assignment create' with --name, --scope, and --policy parameters. az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} matches the correct syntax. Others use incorrect commands or parameters.

2. Final Answer:

   az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} -> Option A

3. Quick Check:

   Correct CLI syntax = az policy assignment create --name MyPolicy --scope /subscriptions/{subId}/resourceGroups/{rgName} --policy {policyDefinitionId} [OK]

Hint: Use 'az policy assignment create' with --scope for resource group [OK]

Common Mistakes:

• Using 'az policy create' instead of 'az policy assignment create'
• Confusing resource group with scope format
• Using wrong parameter names like --definition

3. Given this Azure Policy assignment compliance result:
{"complianceState": "NonCompliant", "resourceId": "/subscriptions/123/resourceGroups/rg1/providers/Microsoft.Compute/virtualMachines/vm1"}
What does this indicate?

medium

A. The compliance state is unknown for vm1

B. The virtual machine vm1 follows the assigned policy rules

C. The policy assignment failed to apply to vm1

D. The virtual machine vm1 does not follow the assigned policy rules

Solution

1. Step 1: Interpret complianceState value and match to meaning

   The value 'NonCompliant' means the resource does not meet the policy requirements. Since vm1 is NonCompliant, it does not follow the assigned policy rules.

2. Final Answer:

   The virtual machine vm1 does not follow the assigned policy rules -> Option D

3. Quick Check:

   NonCompliant means policy not followed [OK]

Hint: NonCompliant means resource breaks policy rules [OK]

Common Mistakes:

• Assuming NonCompliant means policy applied successfully
• Confusing NonCompliant with Unknown or Compliant
• Thinking complianceState shows assignment failure

4. You assigned a policy to a subscription but the compliance report shows no data. What is the most likely cause?

medium

A. The resources are not evaluated yet or policy evaluation is delayed

B. The policy definition is missing required parameters

C. The policy assignment scope is incorrect or too broad

D. The policy assignment was created with the wrong Azure CLI command

Solution

1. Step 1: Understand policy evaluation timing and eliminate other causes

   Policy compliance data can take time to appear after assignment due to evaluation delays. Incorrect scope or missing parameters usually cause errors, not empty compliance. Wrong CLI command would fail assignment.

2. Final Answer:

   The resources are not evaluated yet or policy evaluation is delayed -> Option A

3. Quick Check:

   Compliance delay causes no data [OK]

Hint: Wait for policy evaluation to update compliance data [OK]

Common Mistakes:

• Assuming wrong CLI command always causes no data
• Thinking missing parameters prevent compliance data
• Ignoring evaluation delay after assignment

5. You want to enforce a policy that requires all storage accounts to have secure transfer enabled. You assign this policy at the subscription level with a parameter to exclude a specific resource group. What will happen to storage accounts in that excluded resource group?

hard

A. They will be evaluated but allowed to be non-compliant

B. They will not be evaluated or enforced by the policy

C. They will be forced to enable secure transfer regardless of exclusion

D. The policy assignment will fail due to conflicting parameters

Solution

1. Step 1: Understand policy exclusion parameter effect and confirm behavior on excluded resources

   Excluding a resource group means resources there are not evaluated or enforced by the policy. Excluded storage accounts are ignored by the policy, so no enforcement or compliance checks occur.

2. Final Answer:

   They will not be evaluated or enforced by the policy -> Option B

3. Quick Check:

   Exclusion skips evaluation and enforcement [OK]

Hint: Exclusions skip policy evaluation and enforcement [OK]

Common Mistakes:

• Thinking excluded resources are still checked but allowed
• Assuming policy forces compliance despite exclusions
• Believing exclusions cause assignment failure