L4. Enforcing Compliance with Azure Policy and Microsoft Defender for Cloud Standards

What Azure Policy Actually Does

Azure Policy evaluates resources against business rules and can enforce, audit, or remediate them, complementing Azure RBAC (which controls *who can act*) by controlling *what actions and configurations are allowed regardless of who performs them*.

Built-In vs. Custom Policy Definitions

• Built-in definitions cover common needs out of the box (e.g., "Storage accounts should restrict network access," "Audit VMs that do not use managed disks")
• Custom definitions are written in JSON when no built-in policy matches an organization-specific requirement, defining the resource condition to evaluate and the effect to apply

Policy Effects

Initiatives and Assignment Scope

An initiative (policy set) groups related policy definitions so they can be assigned together as one unit, commonly modeling an entire compliance framework. Assignments apply at a scope (management group, subscription, or resource group), and exemptions let you carve out a specific resource from an assignment without weakening the policy everywhere else, with a documented reason and optional expiration.

Defender for Cloud's Regulatory Compliance Dashboard

Once Defender for Cloud is enabled, every subscription is automatically measured against the Microsoft cloud security benchmark (MCSB) by default. From there you can add additional standards relevant to your industry, such as NIST SP 800-53, PCI DSS, ISO 27001, or SOC 2, and the dashboard shows pass/fail status per control, mapped back to the specific Azure resources and recommendations driving that control's compliance state.

Security Recommendations and Secure Score

Every failed check in Defender for Cloud becomes a recommendation: a specific, actionable fix (e.g., "Enable MFA for accounts with write permissions on this subscription"). Recommendations roll up into Secure Score, a single percentage summarizing your overall security posture, weighted by the relative risk-reduction impact of each recommendation, which gives leadership a trackable number instead of an unstructured list.

Remediation

For DeployIfNotExists and Modify policies, a remediation task applies the fix retroactively to resources that were already non-compliant before the policy existed, rather than only preventing new violations going forward. Defender for Cloud recommendations similarly often expose a "Fix" button that triggers the underlying remediation automatically where the platform supports it. Exam tip: Distinguish Azure Policy (a control-plane gate applied at deployment and continuously afterward, driven by effects like Deny) from Defender for Cloud's compliance dashboard (a continuous grading system against named regulatory standards, driven by recommendations and Secure Score). A scenario asking to *prevent* a specific misconfiguration from being deployed points to Azure Policy with a Deny effect; a scenario asking to *measure standing compliance against PCI DSS* points to the Defender for Cloud regulatory compliance dashboard.