Governance and Compliance

This content was generated with the assistance of AI and should be verified against the official documentation before being relied on in production.

See the section bibliography for the reference material consulted while preparing these pages.

Commands on this page are current for Azure CLI 2.90.0 (checked 2026-09-27); re-verify flag names and built-in definition IDs against az version and the linked reference pages before relying on them, since policy and Defender plan names are exactly the kind of detail Microsoft keeps refining. Two renames trip up anyone reading older material: what shipped as Azure Security Center is now Microsoft Defender for Cloud, and the benchmark it evaluates resources against, once called the Azure Security Benchmark, is now the Microsoft Cloud Security Benchmark — the same rename pattern as Azure Sentinel becoming Microsoft Sentinel. None of the sections below use the old names except to call out the rename itself.

This page covers the controls that apply across rg-bookshelf rather than to any one resource inside it: Azure Policy enforces and audits configuration, Microsoft Defender for Cloud watches the resulting posture and adds threat detection, and Microsoft Sentinel, Microsoft Purview, the Service Trust Portal and Azure’s compliance offerings round out the picture for anyone who has to answer "is this environment compliant" rather than just "is this environment working."

Azure Policy

Azure Policy evaluates resources against rules and either reports on or actively enforces the result, independent of the Azure RBAC role assignments covered on Identity and Access — RBAC controls who can call an API; Policy controls what a resource is allowed to look like, no matter who created it. Three objects make up the model:

Policy definition

A JSON document with a policyRule (an if/then condition over a resource’s properties) and an effect (what happens when the condition matches). Microsoft ships hundreds of built-in definitions (az policy definition list --query "[?policyType=='BuiltIn']"); a custom one is just the same JSON shape, created with az policy definition create.

Initiative (policy set)

A named group of policy definitions, each with its own parameter values, assigned together as a single unit — for example, every definition the Microsoft Cloud Security Benchmark initiative groups ([Microsoft Defender for Cloud]) is assigned once, not one definition at a time.

Policy assignment

A definition or initiative applied at a scope (a management group, subscription, or resource group) with a specific set of parameter values, an optional list of excluded sub-scopes, and, for any effect that needs to write to a resource, a managed identity.

Effects

Effect What it does

Deny

Blocks the create-or-update request outright with a 4xx error before Azure Resource Manager commits it. The strongest effect; used for hard requirements such as "never allow a public IP on this subnet."

Audit

Writes a non-compliance entry to the resource’s compliance record but does not block the request. The usual first step before promoting a rule to Deny, so teams can see the blast radius before it becomes enforcement.

Append / Modify

Add or change a property on the request before it is committed (Append), or on an existing resource after the fact (Modify, which needs a managed identity to make the write). Modify is how a policy can, for example, add a missing tag rather than merely flag its absence.

AuditIfNotExists / DeployIfNotExists

Evaluate a related resource rather than the one being evaluated — for example, "does this VM have a Microsoft Defender for Cloud extension installed." AuditIfNotExists reports the gap; DeployIfNotExists closes it by deploying the missing related resource, and also needs a managed identity.

Manual

Compliance is attested by a person rather than evaluated automatically — used for controls Azure cannot check by itself (a physical-security control, say), which is how Manual-effect policies show up in compliance initiatives without any automated check behind them.

Disabled

Turns a single assignment off without deleting it or touching the shared definition other assignments still use.

When several effects would match the same resource, Azure Policy evaluates them in a fixed order — Disabled, then Append/Modify, then Deny, then Audit/AuditIfNotExists/DeployIfNotExists — so a Deny assignment always wins over an Audit assignment of the same underlying rule.

flowchart LR D["Policy definition\n(rule + effect)"] --> I["Initiative\n(optional grouping)"] I --> A["Assignment\n(scope + parameters + identity)"] A --> E{"Resource create/update\nor periodic scan"} E -- "Deny" --> R1["Request rejected"] E -- "Audit" --> R2["Non-compliant\n(reported, not blocked)"] E -- "Append / Modify" --> R3["Resource written\nwith corrected property"] E -- "AuditIfNotExists /\nDeployIfNotExists" --> R4["Non-compliant\n(gap detected)"] R4 --> RM["az policy remediation create"] RM --> R5["Related resource deployed\n(managed identity)"]

In the Azure portal

  1. Search for Policy and open the Definitions page to browse built-in definitions and initiatives, or select + Policy definition to author a custom one.

  2. Select Assignments → Assign policy, choose the Scope (rg-bookshelf for the examples below), pick a Policy definition, fill in any parameters, and, if the effect needs one, enable Create a Managed Identity under the Remediation tab.

  3. Review + create.

With the Azure CLI

Requiring a tag, using the built-in "Require a tag on resources" definition:

tag_policy_id=$(az policy definition list --query "[?displayName=='Require a tag on resources'].name" -o tsv)

az policy assignment create \
  --name require-cost-center-tag \
  --display-name "Require a tag on resources (CostCenter)" \
  --scope "$(az group show --name "$RG" --query id -o tsv)" \
  --policy "$tag_policy_id" \
  --params '{ "tagName": { "value": "CostCenter" } }'

Denying Shared Key authorization on Bookshelf’s storage accounts, tying back to Storage Accounts's --allow-shared-key-access false flag by enforcing it as policy instead of relying on every az storage account create call remembering the flag:

shared_key_policy_id=$(az policy definition list \
  --query "[?displayName=='Storage accounts should prevent shared key access'].name" -o tsv)

az policy assignment create \
  --name deny-storage-shared-key \
  --display-name "Storage accounts should prevent shared key access" \
  --scope "$(az group show --name "$RG" --query id -o tsv)" \
  --policy "$shared_key_policy_id"

Derived from Azure CLI reference — az policy assignment create and Details of the policy assignment structure.

Note that the built-in "Storage accounts should prevent shared key access" definition ships with the Audit effect by default; assigning it as shown above only reports non-compliant accounts. Bookshelf’s storage account is created with --allow-shared-key-access false directly (Storage Accounts), so the policy assignment here is a safety net that catches any account created outside that convention, not the primary enforcement mechanism.

Remediation

AuditIfNotExists and DeployIfNotExists assignments, and Modify assignments applied to resources that already existed before the assignment was created, do not retroactively fix anything by themselves — a remediation task is a separate, explicit step that re-evaluates existing resources against the assignment and, for effects that write, deploys the missing configuration using the assignment’s managed identity.

A remediation task can only target a deployIfNotExists or modify assignment. The require-cost-center-tag assignment above uses a Deny definition, which blocks new untagged resources but has nothing to remediate, so existing resources are fixed by a second assignment of a Modify definition: the built-in "Inherit a tag from the resource group if missing" copies rg-bookshelf’s `CostCenter tag onto any resource in it that lacks one. A Modify assignment needs a managed identity to make that write, so it’s created with --mi-system-assigned, --location (where the identity lives), and a role assignment for that identity on the resource group. The definition’s roleDefinitionIds lists Contributor.

rg_id=$(az group show --name "$RG" --query id -o tsv)

inherit_tag_policy_id=$(az policy definition list \
  --query "[?displayName=='Inherit a tag from the resource group if missing'].name" -o tsv)

az policy assignment create \
  --name inherit-cost-center-tag \
  --display-name "Inherit the CostCenter tag from the resource group if missing" \
  --scope "$rg_id" \
  --policy "$inherit_tag_policy_id" \
  --params '{ "tagName": { "value": "CostCenter" } }' \
  --mi-system-assigned \
  --location "$LOCATION" \
  --role Contributor \
  --identity-scope "$rg_id"

az policy remediation create \
  --name remediate-cost-center-tag \
  --resource-group "$RG" \
  --policy-assignment inherit-cost-center-tag \
  --resource-discovery-mode ReEvaluateCompliance

Derived from Remediate non-compliant resources, Policy definitions for tagging resources, Azure CLI reference — az policy assignment create, and Azure CLI reference — az policy remediation create.

[[Microsoft Defender for Cloud]] == Microsoft Defender for Cloud

Microsoft Defender for Cloud is the umbrella service that turns Azure Policy’s compliance data into a secure score and adds workload-specific threat detection on top of it — what shipped as Azure Security Center is the same service under its current name, and the sections below use only that current name. A foundational CSPM (Cloud Security Posture Management) layer is enabled free of charge on every subscription — asset inventory, security recommendations, the secure score itself, and continuous assessment against the Microsoft Cloud Security Benchmark (MCSB), the current name for what used to ship as the Azure Security Benchmark: a cross-cloud (Azure, AWS, GCP) set of security controls, each backed by one or more Azure Policy definitions, that Defender for Cloud evaluates automatically once enabled.

The secure score is a single percentage summarizing how many of MCSB’s recommendations a subscription satisfies, weighted by each recommendation’s severity; it is the number to track over time and the one that degrades immediately when, for example, the storage shared-key policy above starts reporting non-compliant accounts.

Paid Defender plans layer workload-specific detection and posture features on top of the free foundation, each enabled independently per subscription (or per connector for a multicloud account):

Plan Adds

Defender CSPM

Attack-path analysis, agentless vulnerability and secret scanning, security governance, and Data-Aware Security Posture on top of the free foundational CSPM layer.

Defender for Servers (Plan 1 / Plan 2)

Endpoint detection and response (via Microsoft Defender for Endpoint), just-in-time VM access, file integrity monitoring, and vulnerability assessment for VMs and VM Scale Sets; aks-bookshelf and `cae-bookshelf’s underlying nodes are covered by Defender for Containers instead.

Defender for Containers

Runtime threat detection, vulnerability scanning of container images in acrbookshelf, and Kubernetes configuration assessment for aks-bookshelf.

Defender for Storage

Malware scanning and anomalous-access detection on Blob/File/Table/Queue data, relevant to stbookshelf.

Defender for SQL / Defender for open-source relational databases (Defender for OSS DB)

Vulnerability assessment and threat detection for `pg-bookshelf’s PostgreSQL flexible server and Azure SQL, respectively.

Defender for Key Vault

Anomalous access-pattern detection on kv-bookshelf.

Defender for App Service / Defender for Resource Manager / Defender for DNS / Defender for APIs

Threat detection for App Service apps, control-plane (ARM) operations, DNS query patterns, and apim-bookshelf-fronted APIs respectively.

Defender for DevOps

Posture findings (secret scanning, IaC misconfiguration, dependency risks) surfaced from connected GitHub/Azure DevOps repositories, complementing Developer Tools and DevOps's DevSecOps practices.

In the Azure portal

  1. Search for Microsoft Defender for Cloud and open the Environment settings page.

  2. Select the subscription, then toggle the plans to enable under Defender plans — for example Defender for Storage and Defender for Containers for Bookshelf.

  3. Secure score and Recommendations on the overview page break every finding down by the Microsoft Cloud Security Benchmark control it maps to.

  4. Regulatory compliance shows the same findings regrouped under whichever compliance standards ([Compliance offerings]) are assigned to the subscription.

With the Azure CLI

az security pricing create --name StorageAccounts --tier Standard
az security pricing create --name Containers --tier Standard

az security pricing show --name StorageAccounts --query pricingTier -o tsv

Derived from Azure CLI reference — az security pricing create and The Microsoft cloud security benchmark in Microsoft Defender for Cloud.

[[Microsoft Sentinel]] == Microsoft Sentinel, briefly

Microsoft Sentinel — the current name for what shipped as Azure Sentinel — is Azure’s cloud-native SIEM and SOAR: it ingests logs from a Log Analytics workspace (the same workspace Monitoring and Observability sends Container Apps, AKS, and Front Door diagnostics to), correlates them against built-in and custom analytics rules to raise incidents, and can run automated playbooks (Logic Apps) in response. Microsoft is consolidating Sentinel’s day-to-day experience into the Microsoft Defender portal rather than the Azure portal: new customers are onboarded there by default, and Sentinel’s own Azure-portal experience is scheduled to retire on 2027-03-31 — worth knowing before bookmarking a workflow against the older portal. For Bookshelf, Sentinel is the natural next step once Defender for Cloud’s alerts and the workspace’s own logs need cross-correlating into incidents rather than reviewed one service at a time; this page does not cover configuring it further, since Bookshelf’s scale does not yet need a dedicated SIEM.

[[Microsoft Purview]] == Microsoft Purview, briefly

Microsoft Purview is Microsoft’s unified data governance, data security, and compliance platform, covering data map/catalog and data-loss-prevention capabilities alongside the compliance tooling relevant here: Compliance Manager, which turns a set of assessments (mapped to standards such as ISO 27001 or NIST 800-53) into a compliance score and a list of improvement actions, similar in spirit to Defender for Cloud’s secure score but covering organizational and data-handling controls rather than resource configuration. Purview’s data-catalog side is out of scope for a Bookshelf-sized deployment; it is mentioned here only so a reader who hears "Purview" in a compliance conversation knows which product is meant.

[[Service Trust Portal]] == Service Trust Portal

The Service Trust Portal (https://servicetrust.microsoft.com) is Microsoft’s public repository of third-party audit reports (SOC 1/2/3, ISO 27001/27017/27018, and dozens more) and whitepapers describing how Microsoft’s own cloud services meet each standard — the artifacts an auditor or a customer’s security team asks for when evaluating whether Azure itself is compliant, as distinct from whether a given Azure deployment is configured compliantly (which is what Azure Policy and Defender for Cloud check). Access to most documents requires signing in with an existing Microsoft 365, Dynamics 365, or Azure subscription; Compliance Manager ([Microsoft Purview]) is where the same standards get turned into an actionable checklist for a specific tenant, rather than just a document library.

[[Compliance offerings]] == Compliance offerings

Azure maintains certifications and attestations against a broad set of industry, government, and regional standards — ISO/IEC 27001, SOC 1/2/3, PCI DSS, HIPAA/HITRUST, FedRAMP High, GDPR-relevant certifications, and many country- or industry-specific standards — published and kept current on the Azure compliance documentation and discoverable per-service from the Service Trust Portal above. Two practical entry points for evaluating whether a specific deployment meets a specific standard: Defender for Cloud’s Regulatory compliance dashboard maps live resource configuration against a chosen standard’s control set (reusing the same underlying assessment data as the secure score), and Compliance Manager ([Microsoft Purview]) tracks the organizational, non-resource controls the same standard also requires. Neither replaces reading the actual standard or engaging an auditor; both narrow down what still needs attention before that conversation. For workloads that use AI, the regulatory and risk-management frameworks are covered in The EU AI Act and NIST AI RMF and AI 600-1.

Azure Blueprints, one of the earlier tools associated with this space, is being retired: Microsoft’s own guidance describes a phased retirement beginning 2026-07-31 (no new blueprint definitions or versions), continuing through 2026-10-31 (no new assignments) and 2026-12-31 (no changes to existing assignments), with full retirement on 2027-01-31. Infrastructure as Code covers the replacement path — Deployment Stacks for locking down a managed set of resources, Template Specs for versioned, shareable templates — in depth; it is mentioned here only because Blueprints combined artifact management with the same "assign a standard set of policies alongside the resources" pattern this page’s Azure Policy assignments now cover on their own.

Clean up

az policy assignment delete --name require-cost-center-tag --scope "$(az group show --name "$RG" --query id -o tsv)"
az policy assignment delete --name inherit-cost-center-tag --scope "$(az group show --name "$RG" --query id -o tsv)"
az policy assignment delete --name deny-storage-shared-key --scope "$(az group show --name "$RG" --query id -o tsv)"

# Disabling a Defender plan stops new billing for it; it does not remove any of the resources it protects
az security pricing create --name StorageAccounts --tier Free
az security pricing create --name Containers --tier Free

az group delete --name "$RG" --yes --no-wait

Related pages

  • Identity and Access covers Azure RBAC, which governs who can act, as distinct from Azure Policy’s control over what a resource is allowed to look like.

  • Resource Organization covers the management-group/subscription/resource-group scopes that policy assignments target.

  • Storage Accounts covers the --allow-shared-key-access false flag the storage policy example above enforces at the fleet level.

  • Infrastructure as Code covers Deployment Stacks and Template Specs, the replacement path for Azure Blueprints.

  • Monitoring and Observability covers the Log Analytics workspace Microsoft Sentinel reads from.

  • EU AI Act and NIST AI RMF cover the AI-specific regulation and risk framework that sit alongside the standards listed above.

  • Cost Management covers Cost Management and Advisor, the cost-focused counterpart to this page’s security- and compliance-focused governance tools.

References