Azure Policy & Compliance
Effects · Initiatives · Remediation · Exemptions · Compliance
Practice questions for this topic →
Effects
| Effect | Does | Needs managed identity? |
|---|---|---|
| deny | Blocks non-compliant create or update | No |
| audit | Logs non-compliance of the resource itself | No |
| auditIfNotExists | Audits when a related resource is missing (for example no diagnostic setting or extension) | No |
| deployIfNotExists | Deploys the missing related resource (nested templates only, not linked templates) | Yes |
| modify | Adds or replaces properties or tags on create or update | Yes |
| append | Adds fields on create or update (prefer modify for tags) | No |
| denyAction | Blocks an action (delete is the only one) on matching resources | No |
| disabled | Turns the policy off | No |
Order of evaluation: disabled → append/modify → deny → audit → manual → auditIfNotExists → denyAction. Existing resources are fixed only by a remediation task. deployIfNotExists runs after a delay once the resource provider returns success.
denyAction in detail
- Returns 403 Forbidden on a delete. Exempt from enforcement: policy assignments, deny assignments, blueprint assignments, deployment stacks, subscriptions and locks, to prevent lockout.
- Resource group deletion: blocked only by policies with
cascadeBehaviorsset to deny, and only for resources that support location and tags (indexed resources). Subscription deletion isn't blocked. - Cascade: deleting a protected parent isn't blocked by a policy on its child or extension resource, but deleting the child itself fails.
Constructs
| Construct | Use for |
|---|---|
| Initiative (policy set) | Group many policies, for example a regulatory standard |
| Assignment scope | Management group, subscription or resource group, with exclusions |
| Exemption | Waive or mitigate a specific resource or scope, optional expiry |
| Remediation task | Apply modify or deployIfNotExists to existing resources |
| Machine configuration | Audit and configure settings inside VMs and Arc servers |
Exam Tips
Tick each tip once you can answer it without looking.
“Only allow resources in East US and West US” → Built-in 'Allowed locations' with deny.
“Only allow specific VM SKUs” → 'Allowed virtual machine size SKUs' (deny).
“Automatically configure diagnostic settings on new resources” → deployIfNotExists (+ managed identity).
“Existing non-compliant resources must be fixed” → Remediation task. Trap: New assignments don't change existing resources automatically.
“Report non-compliance without blocking anyone” → audit / auditIfNotExists.
“Prevent deletion of production databases even by Owners, via policy” → denyAction (delete).
“Policy vs RBAC” → Policy controls WHAT; RBAC controls WHO.
“Apply many related policies for ISO 27001 as one unit” → Initiative.
“One resource legitimately can't comply; keep it compliant in reports” → Policy exemption (waiver/mitigated).
“Audit OS settings inside VMs (e.g. password policy)” → Azure Machine Configuration (guest configuration).
“Resource types exempt from denyAction” → Policy assignments, deny assignments, blueprint assignments, deployment stacks, subscriptions and locks. Trap: This prevents lockout of governance itself.
“denyAction and resource group deletion” → Blocks it only when the policy sets cascadeBehaviors to deny and the resource supports location and tags. Trap: Subscription deletion isn't blocked; delete is the only supported action.
“Azure Policy order of evaluation (Resource Manager mode)” → disabled, then append and modify, deny, audit, manual, auditIfNotExists, with denyAction last. Trap: Append and modify run before deny, so a change they make can stop deny from triggering.
“Match the policy effect to its evaluation rule” → disabled checked first; append and modify before deny; deny before audit; auditIfNotExists assesses a child or extension resource; denyAction last. Trap: Append and modify can stop deny from triggering.