Developer initiates resource deployment
Cloud / Knowledge library
Azure Policy
Audits, denies, modifies, or deploys configuration requirements for Azure resources
Why learn Azure Policy?
Teams use Azure Policy to adopt cloud policy governance without building the complete underlying platform themselves.
The problem it solves
Evaluates and enforces organizational configuration rules across resources
Where it came from
Azure Policy is Microsoft Azure's offering for cloud policy governance. Its closest catalog counterparts are AWS Config and Google Cloud Organization Policy; they address the same broad need but are not feature-for-feature identical.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Explain the main responsibility of Azure Policy.
- Choose a workload that fits Azure Policy.
- Identify one operational tradeoff of Azure Policy.
- Compare Azure Policy with AWS Config.
- Compare Azure Policy with Google Cloud Organization Policy.
Documentation and sources
- Microsoft Azure product catalog (azure.microsoft.com)
Connect the ideas
Alternatives
Real World Example
Automated Resource Governance for Regional Compliance
Organizations with strict data residency requirements for cloud infrastructure.
The business problem
Manual oversight fails to prevent developers from deploying resources in non-compliant regions, leading to regulatory violations.
How this topic solves it
Azure Policy enforces organizational standards by evaluating resource properties against defined rules during deployment or updates.
- Define a policy definition using JSON to specify the allowed locations for resource groups.
- Create a policy assignment to apply the definition to a specific subscription or management group.
- Configure the effect of the policy to Deny, which prevents the creation of resources in prohibited regions.
- Monitor compliance status via the Azure portal to identify existing non-compliant resources.
The lifecycle of a resource request through the Azure Policy engine.
Receives deployment request
Evaluates request against assigned policies
Finalizes or rejects deployment
- User Request → Submit Request → Azure Resource Manager
- Azure Resource Manager → Evaluate Rules → Policy Engine
- Policy Engine → Allow or Deny → Resource Provider
Expected business outcome
Consistent adherence to regional data residency requirements without manual intervention.
Limitations and checks
Policy evaluation is eventually consistent; there may be a short delay between resource creation and the enforcement of the policy, which can be checked via the Activity Log.