Keep in mind that Policy can also be managed and applied at the management group scope. By associating policies with management groups, policy definitions and policy assign- ments can be shared across multiple subscriptions. This includes the ability to monitor multiple subscriptions for compliance. It also allows you to secure the management of organization- wide policy at a level above a single subscription.
When managing resource groups—and in many cases the multiple Azure services that reside within them—Azure Policy with policy definitions and policy assignments can be used to govern those resources. Initiative definitions and initiative assignments can be used to govern those same resources, but instead of applying multiple policy definitions and making multiple policy assignments, you can package or group multiple definitions into a single initiative and then assign that initiative to your desired scope.
Controlling resource groups with Azure Policy is done by scoping the assignment of policy and initiatives. Recall that Azure Policy supports multiple scopes:
When creating assignments, it is also possible to configure excluded scopes. You can always
exclude a subscope. For example, when scoping an assignment to a management group, any subscriptions, resource groups, or even resources that are children of the management
group, can be excluded. When scoping an assignment to a subscription, child resource groups and resources can be excluded. When scoping an assignment to a resource group, only child resources can be excluded.
The flexibility of policy scoping is a powerful feature of Azure Policy. This allows you to model your environments with rich declarations in the form of policy definitions that are applied exactly as required by your organization’s governance needs.
Imagine you have an environment with the following requirements:
and D2 virtual machines that are not promotional.
To model this environment with Azure Policy, you can create two policy definitions (or use built-in policy definitions where applicable), as shown in Table 1-2.
TABLE 1-2 Azure Policy definitions example
| Policy Field | Policy Effect | Description |
| Type | Deny | Do not create virtual machines if they are not in the A-Series or D-Series SKU. |
| tags | Append | Append tag name “Environment” and tag value “Dev/Test” to all resources. |
To reduce administrative overhead, a new initiative definition will be created. Initiative definitions are a collection of policy definitions that are focused on the same goal. They allow for a set of policies to be grouped as a single item.
FIGURE 1-33 Azure Policy Definitions blade
FIGURE 1-34 Azure Policy Initiative Definition blade
FIGURE 1-35 New initiative definition policies and parameters for Azure Policy
From the Policy page, browse to the Assignments blade and click Assign Initiative (see Figure 1-36).
FIGURE 1-36 Azure Policy Assignments blade
FIGURE 1-37 Azure Policy Assign Initiative blade
After policy definitions have been assigned, either through policy assignments or initia- tive assignments, the effects of the policy will be immediately applicable. Policy evaluation for compliance happens about once an hour, which means you might not be able to view the compliance state of a new assignment immediately.
Compliance state can be viewed on the Compliance blade of the Azure Policy service. You can delete, edit, and duplicate the policy assignment by right-clicking it on the Compliance blade, as shown in Figure 1-38.
FIGURE 1-38 Azure Policy Compliance blade
Acedexam Training Policies
Learning resources
Other resources
Our Training Providers
