Azure Policy Complete Guide: Effects, Built-in/Custom, Initiative, Remediation, Compliance

Azure Policy is the Microsoft-managed governance service that defines, enforces, and audits rules against Azure resources in your organization. Applied across the Management Group / Subscription / Resource Group hierarchy, it is the foundational service that automates Azure-wide control and sits at the heart of governance in enterprise Azure environments. This article comprehensively organizes Azure Policy's Effects, Built-in vs Custom, Initiatives, Assignment Scope, Remediation, and compliance use cases.

The 7 Effects

In production, the standard pattern is to introduce in Audit mode and switch to Deny once stable, never going straight to Deny and risking impact on production.

Built-in Policy vs Custom Policy

For new projects, maximize use of Built-in and customize only what is missing. The Azure Policy GitHub repository publishes many industry-standard Custom Policy samples that you can reuse as reference implementations.

Initiative (Policy Set)

An Initiative is a logical unit that groups multiple policies together.

Examples of Microsoft-provided Initiatives

• Microsoft Cloud Security Benchmark (MCSB): Microsoft-recommended security baseline (successor to Azure Security Benchmark)
• PCI DSS v3.2.1: Payment card industry security standard
• ISO 27001:2013: International information security management
• NIST SP 800-53: Security controls for U.S. government
• HIPAA HITRUST: Healthcare information protection
• Australian Government ISM: Australian government information security

Combining an Initiative with the Compliance dashboard visualizes regulatory status across your organization. In production, the standard architecture is to layer 'MCSB Initiative + organization custom Initiative' for hierarchical governance.

Assignment Scope hierarchy

Assignment is the act of attaching a Policy or Initiative to a Management Group, Subscription, or Resource Group, and the targeted range is the Scope.

Hierarchy

• Tenant Root Management Group: Top of the organization
• Management Group: Groups Subscriptions (by environment or department)
• Subscription: Billing boundary
• Resource Group: Logical group of resources
• Resource: Individual Azure resource

Assignments cascade downward (assigning at a Management Group applies to every Subscription beneath it).

Enterprise patterns

1. Assign the 'MCSB Initiative' at the root Management Group in Audit mode for organization-wide coverage
2. Enforce 'Allowed Locations (Japan East only)' on production Subscriptions in Deny mode
3. Apply 'Maximum VM SKU (up to D8s_v5)' to development Resource Groups in Deny mode for cost control

Exclusion lets you exempt specific Resource Groups or resources, providing flexible exception management.

Remediation

Remediation automatically corrects existing non-compliant resources. It is available for policies whose Effect is Modify or DeployIfNotExists.

Typical use cases

1. Existing VMs missing Diagnostic Settings — a Remediation Task bulk-configures them
2. Existing Storage Accounts missing encryption — Remediation applies Customer-Managed Keys in bulk
3. Existing resources missing a CostCenter tag — Remediation auto-inherits the tag value from the Management Group

Remediation runs through a Managed Identity (a System-assigned MI is auto-created when the Policy Assignment is created) and needs Contributor permission against the Scope. In large environments, bulk remediation of thousands of resources can take several hours, so it must be planned.

Standard production policy set

Security

• Storage Account Public Access Disable (Deny)
• Storage Account Minimum TLS 1.2 (Deny)
• VM Disk encryption required (Audit → Deny)
• Enable SQL Database Auditing (DeployIfNotExists)
• Enable NSG Flow Logs (DeployIfNotExists)
• Key Vault Soft Delete + Purge Protection (Audit)

Cost and naming conventions

• Allowed regions restriction (Deny)
• Allowed VM SKU restriction (Deny)
• Require CostCenter / Owner / Project tags (auto-attached via Modify)
• Resource naming convention (Deny, Custom Policy)

Operations

• Auto-configure Diagnostic Settings (DeployIfNotExists)
• Auto-enable Azure Defender (DeployIfNotExists)
• Auto-install Microsoft Defender for Endpoint extension (DeployIfNotExists)

Compliance use cases

The Azure Policy compliance dashboard visualizes your organization's regulatory posture.

• Assign Built-in Initiatives such as MCSB, PCI DSS, HIPAA, ISO 27001, and NIST
• Compliance percentages shown per control
• Lists of non-compliant resources and remediation steps are also surfaced
• Used as evidence in compliance audits (SOC2 Type II, ISO 27001 certification)
• Substantially reduces the cost of reporting to auditors

Integrations with Microsoft Sentinel and Defender for Cloud also enable forwarding policy violation events to the SOC for automated response.

Integration with IaC

Manage Policy, Initiative, and Assignment as code with Bicep or Terraform.

Bicep example

resource policyDef 'Microsoft.Authorization/policyDefinitions@2023-04-01' = {
  name: 'require-tag-CostCenter'
  properties: {
    displayName: 'Require CostCenter tag'
    policyType: 'Custom'
    mode: 'Indexed'
    policyRule: {
      if: {
        field: 'tags.CostCenter'
        exists: 'false'
      }
      then: {
        effect: 'deny'
      }
    }
  }
}

resource policyAssignment 'Microsoft.Authorization/policyAssignments@2024-04-01' = {
  name: 'require-costcenter-tag-assignment'
  properties: {
    policyDefinitionId: policyDef.id
    displayName: 'Require CostCenter tag on all resources'
  }
}

Operational best practices

1. Introduce new policies in Audit mode and switch to Deny once stable
2. Layer governance using the Management Group hierarchy
3. Apply the Microsoft Cloud Security Benchmark (MCSB) Initiative organization-wide
4. Address regulations with industry Initiatives (PCI DSS, HIPAA, etc.)
5. Implement naming and tag enforcement with Custom Policy
6. Use Remediation for incremental cleanup of existing environments
7. Use Exclusion for exception management (emergency response, PoCs, etc.)
8. Treat policy as code with Bicep or Terraform
9. Forward policy violation events to Microsoft Sentinel
10. Submit monthly compliance reports to leadership

Related certifications

• AZ-104 (Administrator): the primary certification for this area, tested in depth in Domain 1
• AZ-305 (Solutions Architect Expert): Domain 1 covers overall governance design
• SC-100 (Cybersecurity Architect Expert): Policy enforcement as part of Zero Trust strategy
• AZ-400 (DevOps Engineer Expert): Combining IaC with Policy

Frequently Asked Questions

Technical information in this article is based on the Azure Policy Documentation. This article is not an official product of Microsoft Corporation and has no affiliation or sponsorship relationship with them. Microsoft and Azure are trademarks of the Microsoft group of companies. Information reflects officially published materials as of May 24, 2026. Always confirm the latest information on the official pages.