This chapter covers Azure Policy, a governance tool for enforcing organizational rules across Azure resources. AZ-900 tests this under objective 3.2, "Describe features and tools for governance and compliance."
Jump to a section
A simple way to picture Azure Policy
A city doesn't inspect every building decision an owner makes one at a time — instead, it publishes building codes that define the rules upfront (minimum wiring standards, fire exits, and so on), and new construction is automatically expected to comply. Azure Policy works the same way for cloud resources: instead of manually reviewing every resource after the fact, an organization defines rules upfront, and Azure Policy automatically evaluates resources against those rules, flagging or even preventing non-compliant ones from being created in the first place.
What Azure Policy is
Azure Policy is a service for creating, assigning, and managing rules (policies) that Azure resources must comply with. Rather than manually checking each resource, Policy automatically evaluates resources against defined rules and can report on, or even prevent, non-compliant configurations.
How it works
A policy definition specifies a rule — for example, "only allow resources to be created in specific regions" or "require a specific tag on all resources." Policies are then assigned to a scope (a subscription, resource group, or management group), and Azure evaluates resources within that scope against the assigned policies.
What Policy can do when a resource is non-compliant
Depending on how a policy is configured, it can simply flag non-compliant resources for review, or it can actively prevent non-compliant resources from being created in the first place — giving organizations a choice between passive monitoring and active enforcement.
Policy initiatives
Multiple related policies can be grouped together into an "initiative," making it easier to assign and manage a set of related rules together rather than one at a time — covered in more detail in a later chapter.
Why this matters for governance
As an organization's cloud footprint grows, manually reviewing every resource for compliance with organizational standards becomes impractical. Azure Policy automates that enforcement, helping ensure consistency at scale.
Define the rule
A policy definition specifies the rule to enforce — for example, restricting allowed resource types, regions, or requiring specific tags.
Assign the policy to a scope
The policy is assigned to a subscription, resource group, or management group, determining which resources it applies to.
Choose the enforcement behavior
The policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created.
Review compliance results
Azure Policy provides visibility into which resources comply with assigned policies and which don't, supporting ongoing governance oversight.
An organization uses Azure Policy to require that every resource be tagged with a department name, making it easier to track costs and ownership across the organization — resources missing that tag are flagged as non-compliant, prompting the team to correct them.
A separate organization uses a stricter policy to actively prevent resources from being created outside of a specific set of approved regions, meeting a regulatory requirement about data residency by enforcing the rule automatically rather than relying on individual engineers to remember and follow it manually every time.
Objective 3.2 expects candidates to understand what Azure Policy does and how it supports governance at scale, distinct from RBAC (which controls who can do what) — Policy controls what configurations are allowed, regardless of who is making the change.
A common wrong answer is confusing Azure Policy with RBAC — RBAC controls access (who can do what); Policy controls resource configuration compliance (what configurations are allowed), regardless of who's making the change. Another common trap is assuming Policy always blocks non-compliant resources — it can be configured to simply report non-compliance instead of actively preventing it.
Stable terms: Azure Policy, policy definition, compliance. Understanding Policy's role in automatically enforcing organizational rules across resources, distinct from access control, is the core exam-relevant distinction.
Memory trick: RBAC controls who can do things. Azure Policy controls what configurations are allowed, automatically checked against every resource in scope.
Azure Policy creates and enforces rules that Azure resources must comply with, automating governance at scale.
Policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created.
Policies are assigned to a scope (subscription, resource group, or management group), applying automatically to resources within it.
Azure Policy is distinct from RBAC — Policy controls configuration compliance, RBAC controls access permissions.
These come up on the exam all the time. Here's how to tell them apart.
RBAC
Controls who can perform actions
Focused on access permissions
Answers: 'Who can do this?'
Azure Policy
Controls what configurations are allowed
Focused on resource compliance
Answers: 'Is this configuration allowed?'
Mistake
Azure Policy and RBAC do the same thing.
Correct
RBAC controls who can perform actions on resources. Azure Policy controls what resource configurations are allowed, regardless of who's making the change — they're complementary but serve different governance purposes.
Mistake
Azure Policy always blocks non-compliant resources.
Correct
Policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created — the enforcement behavior is a configurable choice, not a fixed default.
Mistake
Policies can only be assigned to individual resources one at a time.
Correct
Policies are typically assigned to a broader scope — a subscription, resource group, or management group — automatically applying to all applicable resources within that scope, not configured resource by resource.
It's a governance service that lets organizations define rules (policies) that Azure resources must comply with, automatically evaluating resources against those rules rather than requiring manual review.
RBAC controls who can perform actions on resources (access permissions). Azure Policy controls what configurations are allowed on resources (compliance rules), regardless of who's making the change. They serve complementary but distinct governance purposes.
Not necessarily — it depends on how the policy is configured. It can be set to simply flag and report non-compliant resources, or to actively prevent them from being created in the first place.
You've just covered Azure Policy — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?