# Azure Policy

> Chapter 33 of the Courseiva AZ-900 curriculum — https://courseiva.com/learn/az-900/azure-policy

**Official objective:** 3.2 — Azure Management Governance

## Introduction

This chapter covers Azure Policy, a governance tool for enforcing organizational rules across Azure resources. AZ-900 tests this under objective 3.2, "Describe features and tools for governance and compliance."

## Building Codes, Not Individual Inspections

A city doesn't inspect every building decision an owner makes one at a time — instead, it publishes building codes that define the rules upfront (minimum wiring standards, fire exits, and so on), and new construction is automatically expected to comply. Azure Policy works the same way for cloud resources: instead of manually reviewing every resource after the fact, an organization defines rules upfront, and Azure Policy automatically evaluates resources against those rules, flagging or even preventing non-compliant ones from being created in the first place.

## Core explanation

### What Azure Policy is
Azure Policy is a service for creating, assigning, and managing rules (policies) that Azure resources must comply with. Rather than manually checking each resource, Policy automatically evaluates resources against defined rules and can report on, or even prevent, non-compliant configurations.

### How it works
A policy definition specifies a rule — for example, "only allow resources to be created in specific regions" or "require a specific tag on all resources." Policies are then assigned to a scope (a subscription, resource group, or management group), and Azure evaluates resources within that scope against the assigned policies.

### What Policy can do when a resource is non-compliant
Depending on how a policy is configured, it can simply flag non-compliant resources for review, or it can actively prevent non-compliant resources from being created in the first place — giving organizations a choice between passive monitoring and active enforcement.

### Policy initiatives
Multiple related policies can be grouped together into an "initiative," making it easier to assign and manage a set of related rules together rather than one at a time — covered in more detail in a later chapter.

### Why this matters for governance
As an organization's cloud footprint grows, manually reviewing every resource for compliance with organizational standards becomes impractical. Azure Policy automates that enforcement, helping ensure consistency at scale.

## Real-world context

An organization uses Azure Policy to require that every resource be tagged with a department name, making it easier to track costs and ownership across the organization — resources missing that tag are flagged as non-compliant, prompting the team to correct them.

A separate organization uses a stricter policy to actively prevent resources from being created outside of a specific set of approved regions, meeting a regulatory requirement about data residency by enforcing the rule automatically rather than relying on individual engineers to remember and follow it manually every time.

## Exam focus

Objective 3.2 expects candidates to understand what Azure Policy does and how it supports governance at scale, distinct from RBAC (which controls who can do what) — Policy controls what configurations are allowed, regardless of who is making the change.

A common wrong answer is confusing Azure Policy with RBAC — RBAC controls access (who can do what); Policy controls resource configuration compliance (what configurations are allowed), regardless of who's making the change. Another common trap is assuming Policy always blocks non-compliant resources — it can be configured to simply report non-compliance instead of actively preventing it.

Stable terms: **Azure Policy**, **policy definition**, **compliance**. Understanding Policy's role in automatically enforcing organizational rules across resources, distinct from access control, is the core exam-relevant distinction.

Memory trick: RBAC controls who can do things. Azure Policy controls what configurations are allowed, automatically checked against every resource in scope.

## Step by step

1. **Define the rule** — A policy definition specifies the rule to enforce — for example, restricting allowed resource types, regions, or requiring specific tags.
2. **Assign the policy to a scope** — The policy is assigned to a subscription, resource group, or management group, determining which resources it applies to.
3. **Choose the enforcement behavior** — The policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created.
4. **Review compliance results** — Azure Policy provides visibility into which resources comply with assigned policies and which don't, supporting ongoing governance oversight.

## Comparisons

### RBAC vs Azure Policy

**RBAC:**
- Controls who can perform actions
- Focused on access permissions
- Answers: 'Who can do this?'

**Azure Policy:**
- Controls what configurations are allowed
- Focused on resource compliance
- Answers: 'Is this configuration allowed?'

## Common misconceptions

- **Misconception:** Azure Policy and RBAC do the same thing. **Reality:** RBAC controls who can perform actions on resources. Azure Policy controls what resource configurations are allowed, regardless of who's making the change — they're complementary but serve different governance purposes.
- **Misconception:** Azure Policy always blocks non-compliant resources. **Reality:** Policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created — the enforcement behavior is a configurable choice, not a fixed default.
- **Misconception:** Policies can only be assigned to individual resources one at a time. **Reality:** Policies are typically assigned to a broader scope — a subscription, resource group, or management group — automatically applying to all applicable resources within that scope, not configured resource by resource.

## Key takeaways

- Azure Policy creates and enforces rules that Azure resources must comply with, automating governance at scale.
- Policy can be configured to simply report non-compliance, or to actively prevent non-compliant resources from being created.
- Policies are assigned to a scope (subscription, resource group, or management group), applying automatically to resources within it.
- Azure Policy is distinct from RBAC — Policy controls configuration compliance, RBAC controls access permissions.

## FAQ

**What is Azure Policy?**

It's a governance service that lets organizations define rules (policies) that Azure resources must comply with, automatically evaluating resources against those rules rather than requiring manual review.

**What's the difference between Azure Policy and RBAC?**

RBAC controls who can perform actions on resources (access permissions). Azure Policy controls what configurations are allowed on resources (compliance rules), regardless of who's making the change. They serve complementary but distinct governance purposes.

**Does Azure Policy always prevent non-compliant resources from being created?**

Not necessarily — it depends on how the policy is configured. It can be set to simply flag and report non-compliant resources, or to actively prevent them from being created in the first place.

---

Interactive version with quiz and diagrams: https://courseiva.com/learn/az-900/azure-policy