MSDEVBUILD / azure

Azure Policy

AZURE POLICY Rule: only EU regions, tags required West EU✓ Brazil? North EU✓ DENIED
Azure Policy is the gate: compliant resources pass, and the one in the wrong region is stamped DENIED.

😟 THE PROBLEM

Teams keep creating resources in the wrong regions and without required settings.

😊 THE SOLUTION

Enforce standards automatically with Azure Policy.

  • Resources in forbidden regions✓ Deny with allowed-locations policy
  • Missing tags✓ Modify effect adds them
  • Manual compliance checks✓ Live compliance dashboard
🛠️ Solved with: Azure Policy
Try it yourself in the Azure simulator No Azure account needed. Protect resources with locks 🔒 Try it ❯
Module 3: Management & Governance ⏱ 6 min read Updated 11 Nov 2026

Quick answer

Azure Policy helps you create, assign and manage rules that keep resources compliant with your organisation's standards. Policies evaluate resource properties and can audit, deny, modify or deploy settings automatically. Group related policies into initiatives, assign them at any scope, and see compliance in one dashboard.

Exam objective: 3.2.2 Describe the purpose of Azure Policy. (Skills measured as of July 20, 2026)

Start with a question

How do you stop anyone in the company creating a resource in a forbidden country, even by accident?

You write the rule once in Azure Policy, and Azure blocks it for everyone.

Explain it like I’m 10

The technical explanation

  1. 1 Definition

    Rule: allowed locations = West Europe, North Europe.

  2. 2 Assignment

    Assigned at a management group, subscription or resource group.

  3. 3 Evaluation

    New and existing resources are checked.

  4. 4 Effect

    Deny new violations; audit or remediate existing ones.

Azure Policy in action

Real-world business scenario

Healthcare

A pharmaceutical company

The problem
Clinical data had to stay in the EU and all storage had to use HTTPS, but checks were manual.
What they used
An initiative with 'allowed locations' (Deny), 'secure transfer required' (Deny) and 'require tags' (Modify) at the root management group.
Why that choice
Rules are enforced automatically everywhere.
The result
Zero location violations and a live compliance dashboard for auditors.

When to use it and when not to

✓ Use it when…

  • Enforcing standards: regions, SKUs, tags, encryption, security settings.

✕ Think twice when…

  • Controlling who can perform actions (use RBAC).
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is Azure Policy?

Model answer

A service that enforces rules on Azure resources, like only allowing certain regions or requiring tags, and shows which resources don't comply.

Intermediate What is the difference between a policy and an initiative?

Model answer

A policy definition is a single rule. An initiative groups several related policies, for example everything needed for a regulatory standard, so you can assign and track them together.

Experienced developer How do you introduce Azure Policy without breaking deployments?

Model answer

Assign with the Audit effect first, review compliance, communicate with teams, then switch critical rules to Deny. Use Modify or DeployIfNotExists with remediation tasks for settings that can be fixed automatically, and manage policies as code.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

Which service can deny the creation of resources outside approved regions?

Question 2

Question 2 of 3

What is an Azure Policy initiative?

Question 3

Question 3 of 3 · Select 2

Which TWO are Azure Policy effects?

Quick revision

Key points

  • Azure Policy enforces rules on resource properties.
  • Effects include Audit, Deny, Modify and DeployIfNotExists.
  • Initiatives group related policies.
  • Assign at management group, subscription or resource group scope; inherited downward.
  • Can remediate existing resources.

Important terminology

Policy definition
A rule describing a condition and an effect, such as "deny VMs outside allowed sizes".
Initiative
A group of related policy definitions assigned together.
Effect
What happens when a rule matches, such as Audit, Deny, Modify or DeployIfNotExists.
Remediation
Fixing existing non-compliant resources automatically.

Common mistakes

  • Confusing Policy (what resources look like) with RBAC (who can act).

Exam tips

  • "Only allow resources in specific regions" = Azure Policy.

Five quick revision questions

  1. 1.What does Azure Policy enforce?Show

    Rules on resource properties, such as allowed regions or required tags.

  2. 2.What is an initiative?Show

    A group of related policy definitions.

  3. 3.Name two policy effects.Show

    Audit and Deny (also Modify, DeployIfNotExists).

  4. 4.Can Azure Policy fix existing resources?Show

    Yes, with remediation tasks.

  5. 5.Policy or RBAC? Controlling who can create VMs.Show

    RBAC.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Resource Locks