Azure Policy

​

Overview

​

Capabilities

• Enforce compliance at the Azure subscription or management group level
• Multiple effects: Deny, Audit, Modify, Append, DeployIfNotExists, AuditIfNotExists, DenyAction, and Disabled
• Built-in and custom policy definitions
• Initiative (policy set) grouping for compliance standards

​

Limitations

• Requires an Azure subscription
• Only applicable to Azure cloud environments — check out AWS SCP for AWS or Google Cloud Organization Policy for Google Cloud environments

​

Generated Format

• Language: JSON
• Structure: Azure Policy definition with policyRule containing if/then conditions
• Execution: Applied via Azure Portal, CLI, ARM templates, Bicep, Terraform, or REST API

​

Example Guardrail

{
  "properties": {
    "displayName": "Require minimum TLS 1.2 on storage accounts",
    "policyType": "Custom",
    "mode": "All",
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [
          {
            "field": "type",
            "equals": "Microsoft.Storage/storageAccounts"
          },
          {
            "field": "Microsoft.Storage/storageAccounts/minimumTlsVersion",
            "notEquals": "TLS1_2"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}