Azure Policy Initiatives

Azure Policy is a service that allows you to create, assign, and manage policies that enforce rules for your Azure resources. However, in a real enterprise, you rarely need just one rule. You need a set of rules that work together to achieve a compliance goal. For example, to ensure a resource is secure, you might need rules that enforce HTTPS, require encryption, and restrict public access. Creating and assigning each rule individually is inefficient and error-prone. This is where Azure Policy Initiatives come in.

An Azure Policy Initiative is a collection of policy definitions (individual policies) that are grouped together to achieve a specific compliance goal, such as 'Enable Monitoring in Azure Security Center' or 'Ensure Secure Access to Resources.' Initiatives simplify management by allowing you to assign a single object that contains multiple policies. When you assign an initiative to a scope (management group, subscription, resource group), all the policies in that initiative are evaluated against every resource in that scope. This ensures consistent enforcement and auditing across your environment.

Azure Policy itself is a free service. There is no cost for creating, assigning, or evaluating policies and initiatives. However, if you use remediation tasks that involve deploying resources (e.g., deploying a Log Analytics agent), you may incur costs for those resources.

In an on-premises environment, enforcing a set of rules across servers and applications typically involves manual checks, custom scripts, or third-party configuration management tools like Group Policy or Chef. These tools require significant setup and maintenance. Azure Policy Initiatives automate this process at the cloud scale. Instead of manually checking each server, you define your rules once and Azure automatically evaluates all resources. Additionally, Azure Policy integrates with Azure DevOps for policy-as-code, allowing you to version control and deploy policies alongside your infrastructure.

Azure Portal:

Azure CLI:

# Create a custom initiative definition
az policy initiative create --name "MyInitiative" --policy-definitions '[
  {
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/...",
    "parameters": {}
  }
]' --display-name "My Initiative" --description "Ensures..."

# Assign an initiative to a subscription
az policy assignment create --name "MyAssignment" --policy-set-definition "MyInitiative" --scope /subscriptions/{subscriptionId}

# View compliance state
az policy state list --resource "/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/{vmName}"

PowerShell:

# Create an initiative definition
$definition = New-AzPolicySetDefinition -Name 'MyInitiative' -PolicyDefinition @(
    @{ PolicyDefinitionId = '/providers/Microsoft.Authorization/policyDefinitions/...'; Parameters = @{} }
) -DisplayName 'My Initiative' -Description 'Ensures...'

# Assign initiative
New-AzPolicyAssignment -Name 'MyAssignment' -PolicySetDefinition $definition -Scope '/subscriptions/{subscriptionId}'

# Get compliance state
Get-AzPolicyState -ResourceId '/subscriptions/{subscriptionId}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/{vmName}'

Scenario 1: Financial Services Company A bank must comply with PCI DSS. They create an initiative 'PCI DSS Compliance' that includes policies for encryption at rest, encryption in transit, network security groups rules, and logging. They assign this initiative to all subscriptions that handle credit card data. Any new resource that violates a policy is denied or audited, and the compliance team gets a clear view of non-compliant resources.

Scenario 2: Healthcare Provider A hospital needs to enforce HIPAA rules. They use built-in initiatives like 'HITRUST/HIPAA' which includes over 100 policies. They assign it to their production subscription. When a developer tries to create a storage account without encryption, the policy denies the creation. The initiative ensures that all resources meet the required security baseline.

Scenario 3: Retail Company A retail chain wants to ensure all resources are deployed only in approved Azure regions (US East, US West) and that all disks are encrypted. They create a custom initiative with two policies: 'Allowed Locations' and 'Audit Unencrypted Disks'. They assign it to their entire management group. Any resource in an unapproved region is denied, and unencrypted disks are audited. The compliance dashboard shows which resources need attention.

Scenario 1: Multi-National Corporation Enforcing Data Residency A global company must ensure that all customer data remains within specific geographic boundaries due to GDPR. They create a custom initiative called 'GDPR Data Residency' that includes the built-in policy 'Allowed Locations' parameterized to only allow EU regions (e.g., West Europe, North Europe). They also include a custom policy that denies creation of resources without a data residency tag. They assign this initiative to all subscriptions that process EU customer data. The compliance team monitors the dashboard weekly. When a developer in the US accidentally tries to deploy a storage account in East US, the policy denies the creation, and the developer receives an error message. This proactive enforcement prevents costly compliance violations. If the initiative were not in place, the resource would be created, and the company might face fines during an audit.

Scenario 2: Healthcare Provider Automating Security Baselines A hospital uses the built-in 'HITRUST/HIPAA' initiative, which contains over 100 policies covering encryption, network security, logging, and access controls. They assign this initiative to their production subscription. The initiative includes a policy that audits VMs without disk encryption. The compliance dashboard shows that 15 VMs are non-compliant. The security team creates a remediation task for the disk encryption policy, which automatically encrypts the disks using Azure Disk Encryption. Without the initiative, the team would have to manually check each VM and apply encryption, which is error-prone and time-consuming. The initiative also includes a policy that denies creation of VMs without encryption, preventing future non-compliance.

Scenario 3: Retail Chain Managing Multiple Subsidiaries A retail chain has multiple subsidiaries, each with its own subscription. The central IT team wants to enforce a common set of policies across all subsidiaries, such as requiring all resources to have cost center tags and be deployed in approved regions. They create a custom initiative 'Common Governance Baseline' that includes policies for tagging and allowed locations. They assign this initiative to the root management group, which covers all subscriptions. Each subsidiary can still have its own additional policies or exclusions. The central team can view compliance across the entire organization from a single dashboard. If a subsidiary creates a resource without the required tags, it is marked non-compliant, and the central team can follow up. This centralized governance ensures consistency while allowing autonomy. Without the initiative, each subsidiary would need to implement the same policies individually, leading to inconsistencies and administrative overhead.