Azure Policy Remediation Tasks

Azure Policy evaluates resources against policy definitions and assigns an effect: Deny (block creation), Audit (log non-compliance), Append (add fields), or Modify (alter properties). The Modify effect—and its companion, Remediation Tasks—is how Azure Policy can automatically fix non-compliant resources after they exist. Remediation is not a separate policy effect; it is a post-evaluation action that applies the Modify effect to existing resources.

Remediation tasks are created at the scope of a policy assignment (management group, subscription, resource group). When triggered, the task uses a system-assigned or user-assigned managed identity to execute a deployment template (called a 'remediation template') that makes the required changes. The task runs asynchronously and can be monitored via Azure Portal, CLI, or PowerShell.

Policy effects like Deny and Audit are passive: Deny prevents non-compliant resources from being created, but does nothing for existing ones. Audit only logs compliance state. Append can add tags or fields at creation time, but cannot modify existing resources. Only the Modify effect can change existing resources, but it does so only when a resource is created or updated (at evaluation time). To fix resources that were created before the policy was assigned, or that became non-compliant due to policy changes, you need a remediation task.

Azure Portal: 1. Navigate to Policy > Remediation. 2. Select the policy assignment. 3. Click 'Create Remediation Task'. 4. The task runs immediately. You can monitor progress in the Remediation tasks pane.

Azure CLI:

# Create a remediation task for a policy assignment
az policy remediation create --name myRemediation --policy-assignment myAssignment

# List remediation tasks
az policy remediation list

# Show status of a task
az policy remediation show --name myRemediation

# Cancel a task
az policy remediation cancel --name myRemediation

PowerShell:

# Create a remediation task
New-AzPolicyRemediation -Name myRemediation -PolicyAssignmentId /subscriptions/{subId}/providers/Microsoft.Authorization/policyAssignments/myAssignment

# Get remediation task status
Get-AzPolicyRemediation -Name myRemediation

# Remove a remediation task
Remove-AzPolicyRemediation -Name myRemediation

Verification: After remediation, check the resource's compliance state via Policy > Compliance. Resources that were successfully remediated should change from 'Non-compliant' to 'Compliant' or 'Exempt' depending on the policy.

When creating a remediation task via CLI or PowerShell, you can specify: - --resource-discovery-mode (CLI) or -ResourceDiscoveryMode (PowerShell): Values are 'ExistingNonCompliant' (default) or 'ReEvaluateCompliance'. 'ExistingNonCompliant' only remediates resources currently shown as non-compliant. 'ReEvaluateCompliance' re-evaluates all resources in scope first, then remediates any that become non-compliant. - --parallelism (CLI) or -ParallelismDeploymentCount (PowerShell): Number of resources to remediate concurrently (default 5, max 50). - --failure-threshold (CLI) or -FailureThreshold (PowerShell): Percentage of resources that can fail before the task stops (default 100, meaning ignore failures).

Policy Definition:

{
  "policyRule": {
    "if": {
      "field": "type",
      "equals": "Microsoft.Compute/virtualMachines"
    },
    "then": {
      "effect": "Modify",
      "details": {
        "operations": [{
          "operation": "add",
          "field": "tags.Environment",
          "value": "Production"
        }]
      }
    }
  }
}

Assignment: Assign this policy at subscription scope with a system-assigned managed identity. The identity needs 'Virtual Machine Contributor' role on the subscription.

Remediation: Create a remediation task. The task will iterate over all non-compliant VMs and add the tag 'Environment: Production'.

A large enterprise with 10,000+ VMs across multiple subscriptions needs to enforce a mandatory 'CostCenter' tag on all VMs. They create a policy with Modify effect that adds the tag with a default value 'Unassigned' if missing. Initially, only 60% of VMs have the tag. The administrator creates a remediation task at the management group scope. The task processes 5,000 non-compliant VMs in about 45 minutes. However, they hit ARM throttling limits because of other concurrent operations. They reduce parallelism to 3 and schedule remediation during off-peak hours. After remediation, they run a compliance scan to verify. Common issues: the managed identity lacked 'Contributor' on some resource groups, causing partial failure. They had to grant permissions at the management group level to ensure uniform access.

A financial services company must ensure all storage accounts have 'requireInfrastructureEncryption' enabled. They use a policy with Modify effect to set this property. However, the property is not directly modifiable via ARM for existing storage accounts; it can only be set at creation time. The remediation task fails for all existing storage accounts because the ARM API rejects the change. This is a common gotcha: not all properties are modifiable after creation. The team had to use a custom script (Azure Automation) to recreate storage accounts with the correct setting. This scenario highlights that remediation only works for properties that support in-place updates.

A software company uses Azure Policy to enforce that all resources have specific tags (e.g., 'Environment', 'Owner'). Developers sometimes accidentally remove tags during deployments. They integrate remediation tasks into their CI/CD pipeline. After each deployment, a script runs an on-demand compliance evaluation and triggers remediation for any non-compliant resources. This ensures rapid correction. However, they must be careful not to create infinite loops: if the remediation itself triggers a new deployment that changes the tags, it could cause continuous remediation. They use exclusion scopes to exempt the pipeline's own resources. Also, they set a failure threshold so that if more than 10% of resources fail, the pipeline stops and alerts.