What is Azure Policy?
Azure Policy is a governance service that enforces organizational standards and assesses the compliance of Azure resources at scale. Policy definitions written in JSON specify rules that are evaluated when resources are created, updated, or periodically re-assessed - violations can be blocked, logged, or automatically remediated.
Policies can be applied centrally to management groups, subscriptions, resource groups, or individual resources; via Azure Arc, policy-based governance can also be extended to other cloud providers and on-premises datacenters.
Core Features
- Policy definitions in JSON for virtually any resource property, including parameters for reusability
- Initiatives (PolicySets) for grouping multiple policies around a shared goal
- Compliance dashboard with aggregated and per-resource evaluation
- Remediation tasks that use managed identities to automatically fix existing non-compliant resources
- Policy exemptions for justified, time-limited exceptions
- A large library of built-in policy definitions for common governance scenarios as a starting point for custom rules
Typical Use Cases
Tagging enforcement: Ensuring all resources are created with required tags (e.g. CostCenter, Owner, Environment).
Location restrictions: Restricting resource deployment to approved regions for data residency compliance.
Security baseline: Enforcing settings such as allowed VM or storage SKUs, encryption, or mandatory tags across all resources, often combined into initiatives such as those used with Microsoft Defender for Cloud.
Benefits
- Free service for all Azure customers
- Proactive prevention of policy violations through deny or modify effects
- Automatic correction of existing non-compliant resources through remediation
- Audit trail for compliance evidence, complementing Azure RBAC
Frequently Asked Questions
What does Azure Policy cost?
Azure Policy is free to use for all Azure customers. There are no additional costs for policy evaluations or remediation tasks.
What is the difference between Deny and Audit?
Deny blocks the creation or modification of a non-compliant resource. Audit or AuditIfNotExists allows the action but creates a compliance entry for reporting purposes - recommended as a first step before enforcing a policy with a blocking effect.
Can I create custom policies?
Yes, custom policies are defined in JSON and can check virtually any property of an Azure resource. Microsoft also provides a large set of built-in policies as templates for common governance and compliance scenarios.
How do remediation tasks work?
Remediation tasks use managed identities to automatically adjust existing non-compliant resources, for example for policies with the “deployIfNotExists” or “modify” effects. Which properties get corrected is defined in the policy definition.
Integration with innFactory
As a Microsoft Solutions Partner, innFactory supports you with Azure Policy: governance strategy, policy development, compliance reporting, and remediation.
Note: All product information on this page has been compiled with care, but is provided without guarantee and may be outdated or incomplete. Cloud services evolve rapidly — features, pricing, SLAs, and availability change frequently. Authoritative and up-to-date information can only be found on the official product page of Azure (official documentation). This page does not represent an offer by Azure.
