Azure Policy
Guardrails over resource properties: audit, deny, append, modify or deploy remediation on anything inside the assigned scope.
Readiness
0%
2h 20m baseline
Exam memorization points
- Object model: policy definition (if/then JSON) > initiative (a set of definitions, also called a policy set) > assignment (scope plus parameters plus effect).
- Effects: Deny, Audit, Append, Modify, DeployIfNotExists, AuditIfNotExists, Disabled, and the newer Manual and EnforceOPAConstraint/DINE variants.
- Deny blocks the request at create or update time. Audit and AuditIfNotExists only record non-compliance.
- Modify and DeployIfNotExists change or create resources and therefore need a managed identity on the assignment plus a remediation task for existing resources.
- Assignments inherit down the management group hierarchy. Exemptions carve out scoped exceptions, optionally with an expiry date.
- Compliance is evaluated on resource changes and by a periodic scan (roughly every 24 hours); an on-demand evaluation scan can be triggered.
Traps & distractors
- Expecting Azure Policy to change existing resources automatically. Without a remediation task the resource stays non-compliant.
- Confusing policy with RBAC. Policy constrains what a resource may look like; RBAC constrains who may act.
- Forgetting the managed identity when using DeployIfNotExists or Modify, which makes the assignment fail at remediation time.
- Using Deny on an initiative at a scope where resources are already deployed - deny only stops future writes.
- Assuming a deny assignment and a policy Deny are the same thing. Policy deny lives in the policy engine; deny assignments come from Blueprints or deployment stacks.
Suggested lab
Deny, audit and remediate
Observe the difference between a blocking effect and a remediating effect.
- 1Assign the built-in Allowed locations initiative at the subscription scope with Deny, allowing only your home region.
- 2Attempt to deploy a storage account in a different region and capture the validation error.
- 3Assign the built-in Inherit a tag from the resource group policy with the Modify effect and a system-assigned managed identity.
- 4Create a remediation task and confirm the tag appears on non-compliant resources.
- 5Create an exemption for one resource group with an expiry date and re-check compliance.
Microsoft Learn
- What is Azure Policy?doc
- Search Microsoft Learn: Azure Policy effects remediation task exemptionsearch
Live Microsoft Learn ingestion is a Sprint 2 item; until then links are curated and the search fallback always resolves.
Status
No time invested yet. Baseline assumptions only.
Self-assessed mastery
0%
Critical priority
High-yield and still weak. Study this next.
- Exam importance100% × 30% = 30.0
Learner-agnostic frequency on the real exam (5/5).
- Blueprint weight100% × 25% = 25.0
This topic's domain carries 22.5% of the exam objectives.
- Dependency leverage0% × 20% = 0.0
Nothing else in the graph depends on this topic.
- Current gap100% × 25% = 25.0
Readiness is 0%, so 100% of the topic is still uncovered.
Exam Priority Score = 30% importance + 25% blueprint + 20% dependency + 25% gap. Importance is exam frequency, blueprint is the domain's official exam weight, dependency is how many later topics this one unlocks, and gap is how far you currently are from ready.
Unlocks next
Leaf topic - nothing depends on it.
Baseline study time
2h 20m
Complexity
3 / 5
Remaining to target
1h 59m
Status weight
0%
Topics: policy, initiative, guardrails, compliance, deny, remediation, exemption
Weak neighbours in Identities