TopolearnPolicy is how platform teams make guardrails automatic instead of relying on reviews.
Azure Policy evaluates resource properties against rules when resources are created or updated, and periodically for compliance reporting. A policy definition has an if condition over resource fields (aliases such as Microsoft.Storage/storageAccounts/minimumTlsVersion) and a then effect:
Deny: block the request.Audit/AuditIfNotExists: mark non-compliant, allow it.Modify/Append: change the request, e.g. add a tag.DeployIfNotExists: deploy a related resource, e.g. a diagnostic setting or private DNS record.DenyAction: block specific actions such as delete.Disabled,Manual.
Definitions are grouped into initiatives (policy sets) like the Microsoft cloud security benchmark, and assigned at a management group, subscription or resource group, with parameters, exclusions and exemptions (waiver or mitigated, ideally with an expiry).
Modify and DeployIfNotExists need the assignment to have a managed identity with the right roles. They act on new and updated resources; existing ones need a remediation task.
Roll out safely: assign with enforcementMode: DoNotEnforce or the Audit effect first, review compliance, then switch to Deny. Manage definitions and assignments as code alongside your Bicep, and use parameters so one definition serves many environments.
Example
{
"properties": {
"displayName": "Require a costCenter tag on resource groups",
"mode": "All",
"parameters": {
"effect": { "type": "String", "allowedValues": ["Audit", "Deny"], "defaultValue": "Audit" }
},
"policyRule": {
"if": {
"allOf": [
{ "field": "type", "equals": "Microsoft.Resources/subscriptions/resourceGroups" },
{ "field": "tags['costCenter']", "exists": "false" }
]
},
"then": { "effect": "[parameters('effect')]" }
}
}
}Remember
- Definition = if condition + effect; initiative = set of definitions
- Assign at management group, subscription or resource group scope
- Modify and DeployIfNotExists need a managed identity and remediation for existing resources
- Audit first, then enforce
Watch out for
- Rolling out Deny policies straight to production and breaking pipelines that create non-compliant resources.