Describe the purpose of Azure Policy

Azure Policy is a service in Microsoft Azure that helps you enforce and validate organizational standards and to assess compliance at scale. With Azure Policy, you can create, assign and, manage policy definitions to enforce rules for your resources, so those resources remain compliant with your corporate standards and service level agreements. Azure Policy does this by evaluating your resources for non-compliance with assigned policy definitions.

One of the primary purposes of Azure Policy is to ensure that resources within your Azure environment align with your organization’s compliance requirements and security best practices. This is critically important in any enterprise governance strategy where multiple teams and departments are deploying and managing resources independently.

Azure Policy Features

Azure Policy helps in various ways:

• Compliance Assessment: Continuously evaluates the deployment and configuration of your resources to ensure they are compliant with specified policies. It keeps track of your compliance status and reports any existing non-compliance issues.
• Remediation: In the case of non-compliant resources, you can perform remediation tasks. Some policies can be configured to automatically remediate non-compliant resources by creating and managing corrective tasks.
• Resource Optimization: Prevents resources from being deployed that do not adhere to your organization’s cost or size requirements, which helps control costs and optimize usage.
• Security Enhancement: Enforces security best practices by restricting how resources can be configured, such as enforcing specific networking rules or ensuring encryption is enabled on storage accounts.
• Audit: Tracks and captures the state of your resources to aid in auditing and regulatory compliance.

Examples of Azure Policies:

• Ensure that all storage accounts use secure transfer: A policy can be put in place that requires secure transfer to be enabled for storage accounts. This ensures that any data transfer to and from the storage account is encrypted and secure.
• Enforce tagging rules: Policies may require all resources to include specific tags. Tags help organize resources for billing or management and enforce accountability.
• Restrict locations for new resources: Organizations often need to restrict the deployment of resources to specific Azure regions due to compliance, data sovereignty, or latency considerations.
• Disallow certain resource types: If certain Azure resource types shouldn’t be used within the organization, a policy can be implemented to prevent their deployment.
• Require SQL Server auditing: You can enforce the enablement of auditing on SQL Servers which helps you maintain an audit trail of database activities.

Azure Policy Definitions and Assignments:

Policies in Azure are defined using JSON (JavaScript Object Notation). A policy definition contains conditions under which it’s enforced and the effect that happens if the conditions are met. The policy definition schema includes fields like mode, parameters, display name, description, policy rule, and so on.

To apply a policy, it should be assigned to a scope: a management group, a subscription, or a resource group. You can also include exclusions if you want to skip specific resources within the assigned scope.

Initiatives:

When you have several related policies that you want to group and deploy as a single item, you use an initiative. An initiative defines a larger goal that you want to achieve, which could encompass multiple policy definitions.

Compliance Reports:

After policies are assigned, Azure Policy provides detailed compliance reports that identify the status of resources in your environment. These reports help you understand the current state of compliance and track changes over time.

Benefits of Azure Policy:

Utilizing Azure Policy effectively is a fundamental part of managing Azure at scale and ensuring a compliant, secure, optimized, and well-governed cloud environment. As an integral tool for Azure management, understanding and leveraging Azure Policy is beneficial for individuals preparing for the AZ-900 Microsoft Azure Fundamentals exam, as it forms a core part of the platform’s governance capabilities.