Azure Policy & Blueprints: AZ-500 Compliance Enforcement

What Is Azure Policy?

Azure Policy evaluates resources against rules (policy definitions) and enforces compliance. Policies do not retroactively fix non-compliant resources: they prevent future violations (Deny effect) or report existing ones (Audit effect).

Policy Effects

Exam tip: DeployIfNotExists and Modify effects require a managed identity assigned to the policy assignment: the policy needs permission to make changes.

Initiatives (Policy Sets)

An Initiative is a collection of policy definitions grouped for a common goal. Example: the "Azure Security Benchmark" initiative contains 200-plus policies that together implement the ASB framework.

Assign an initiative to a management group, subscription, or resource group: all child resources inherit the assignment.

Exemptions and Exclusions

• Exclusion scope: Exclude a specific resource group or resource from a policy assignment entirely
• Exemption: Mark a specific resource as "waived" or "mitigated" with an expiry date

Exam tip: Exemptions are auditable and time-bound. Exclusion scopes are permanent and not audited as exceptions.

Azure Blueprints

Blueprints bundle role assignments, policy assignments, ARM templates, and resource groups into a single deployable package. They enforce governance at subscription creation time. Exam trap: Blueprints are being deprecated in favour of Deployment Stacks. The exam may still test Blueprints: know they exist and that they combine Policy plus RBAC plus templates.