The problem it solves
Ravi has Contributor on the Prod subscription, so he can build anything. On a busy afternoon he creates a VM in West Europe by leaving the region drop-down on its default, and a storage account with no CostCentre tag. Nothing in RBAC stops him, because RBAC only asks "is Ravi allowed to create VMs?" and the answer is yes. Contoso needs a second question: "is this VM allowed to exist?" That is Policy.
What this means
- Policy applies to everyone, including Owners
- It runs on every create and update, and on a schedule for existing resources
- A refused request shows the policy name in the error, so Ravi knows why
- Existing resources that break a rule are flagged, never deleted
The four words
| Word | Plain meaning | Built-in or yours? |
|---|---|---|
| Definition (one rule: a condition plus what to do about it) | "Allowed locations", "Require a tag", "Allowed VM SKUs" | Hundreds are built in. You write your own (JSON with an if condition and a then effect) only when the rule is company-specific, such as a naming pattern. |
| Initiative (a bundle of definitions handled as one; also called a policy set) | "ISO 27001 baseline", "Enable Azure Monitor for VMs" | Built-in sets exist; you can make your own bundle of built-ins. |
| Assignment (applying a definition or initiative to a scope, with parameters and exclusions) | "Allowed locations = Australia East, Australia Southeast, at MG-Corp, excluding RG-Sandbox" | Always yours; this is the act that makes a rule live. |
| Compliance | The dashboard: how many resources pass or fail each assignment | Automatic. |
Assign at the highest scope that should obey the rule, usually a management group, so every subscription inherits it. Exclusions carve out a sandbox. Scope inheritance works exactly like RBAC: down only.
Quick check
You assign the built-in "Allowed locations" policy (Deny effect, Australia East only) at the Prod subscription. A storage account already exists in West Europe. What happens to it?
Effects: what a rule can do
Learn these by the verb in the question.
| If the requirement says… | Effect | New resource | Existing resource | Built-in example |
|---|---|---|---|---|
| "prevent", "block", "must not be possible" | Deny | Refused | Flagged | Allowed locations; Allowed virtual machine size SKUs; Not allowed resource types |
| "report", "identify", "without preventing" | Audit / AuditIfNotExists | Allowed, flagged | Flagged | Audit VMs without managed disks |
| "automatically add a tag", "inherit the tag" | Modify | Changed on the way in | Fixed by a remediation task | Inherit a tag from the resource group |
| "ensure the agent/diagnostic setting is installed" | DeployIfNotExists | Companion resource deployed (needs a managed identity on the assignment) | Fixed by a remediation task | Deploy Log Analytics agent |
| older style "add a value" | Append | Field added | Flagged | Append a tag |
| "temporarily switch the rule off" | Disabled | — | — | — |
A remediation task (a job you start from Policy › Remediation that applies Modify or DeployIfNotExists to resources that already existed before the assignment) is how you bring old resources into line; Deny and Audit have nothing to remediate.
Quick check
Every new resource in RG-Finance must carry CostCentre = 4471 even when the person creating it forgets. Which effect?
Policy and RBAC together
They are independent and both must pass. An Owner is still refused by a Deny. A Reader is still blocked by RBAC even if Policy would allow the resource. Exam questions sometimes offer "give the user a different role" as a fix for a Policy refusal; it is never the answer.
Memorise (definitions)
- Definition → initiative → assignment → compliance → remediation
- Effects: Deny, Audit, Modify, DeployIfNotExists, Append, Disabled
- Existing resources are flagged, never deleted
- Owner is still blocked by Deny
- Modify / DeployIfNotExists are the only remediable effects
Apply (scenarios you must solve)
- Pick the effect from the verb (prevent / report / add / ensure)
- Choose the scope so all subscriptions inherit, with a sandbox excluded
- Explain what happens to resources that already exist
- Fix non-compliant old resources: remediation task
- Spot that changing a role will not fix a Policy refusal
You, the admin: nothing may be built outside Australia, company-wide
- Policy › Definitions, search Allowed locations (built-in; nothing to write).
- Click Assign. Scope: management group MG-Corp. Exclusions: RG-Sandbox.
- Parameters: tick Australia East and Australia Southeast. Review + create.
- Within about 30 minutes Policy › Compliance lists the West Europe storage account as non-compliant. Decide with its owner whether to move or delete it; Policy will not.
- Second rule: assign Inherit a tag from the resource group (Modify) for CostCentre at the Prod subscription, then Policy › Remediation › Create remediation task so existing resources get the tag.
Script: az policy assignment create --name allowed-au --policy e56962a6-4747-49cd-b67b-bf8b01975c4c --scope /providers/Microsoft.Management/managementGroups/MG-Corp --params '{"listOfAllowedLocations":{"value":["australiaeast","australiasoutheast"]}}'. Custom rule: az policy definition create --name x --rules rule.json.