5.2Governance and Compliance

Using the cloud in an organization requires governance—enforcing rules, preventing mistakes, granting permissions only to the right people, and staying compliant. Azure supports these with separate mechanisms. They are easy to confuse, so the trick is to organize them by what each one controls.

5.2.1Enforcing rules: Azure Policy

Azure Policy defines and enforces "conditions resources must meet" as rules (e.g., restrict allowed regions, require tags, limit VM sizes). It can deny non-compliant creation, evaluate compliance of existing resources, and even auto-remediate. A policy initiative bundles many policies to apply a whole set of rules (e.g., for a regulatory standard) at once.