Azure Policy: Compliance and Exemptions¶
Azure Policy enforces rules on your subscription. Policies come from the platform baseline (assigned on the management groups). Some deny a deployment, some deploy missing settings (DeployIfNotExists), some only audit.
What the baseline typically does¶
| Effect | What it means for you | Example |
|---|---|---|
| Deny | Your deployment is blocked. Change your design. | Public endpoints on PaaS services, public IP addresses, deployment in a non-approved region |
| DeployIfNotExists | The platform adds a setting for you | Private DNS zone group for a private endpoint, diagnostic settings |
| Modify | A property is corrected | Tags |
| Audit | Shows up as non-compliant, nothing is blocked | Security benchmark initiatives |
The set of policies, initiatives and exemptions of your platform is configured in the configuration repository and differs per customer. Ask your platform team for the list, or read it under Policy → Assignments in the portal. Operators: see Policy assignments.
An example from a customer platform
One customer platform assigned: deny RDP from the internet, deny standalone public IPs on landing zones, allow only three European regions, deny public PaaS endpoints, deploy private DNS zone groups, deploy diagnostic settings, plus audit initiatives for the Microsoft cloud security benchmark, CIS and the Dutch BIO. Your platform may be different. Always check your assignments.
Fix issues in dev and tst first
Some platforms only audit the baseline initiatives in dev and tst, and enforce them (with deny effects) in
acc and prd. Non-compliance then shows up in the portal without blocking you, until the same code is deployed to
acc or prd and is denied. If your platform works this way, check the compliance of your dev and tst
subscriptions regularly and fix issues there, before you go to acceptance and production.
Find compliance issues¶
- In the Azure portal open Policy, then Compliance.
- Filter on your subscription, resource type, policy definition and Non-compliant state.
- Open a policy assignment, choose the Resource compliance tab, and read the Details for the reason.
The platform can also e-mail the non-compliant policies per spoke to a team mailbox. Ask whether this is on for you.
Fix compliance issues¶
- Fix in code (preferred). Change your Terraform or Bicep so the resource meets the policy. Compliance is re-evaluated later, which can take a while.
- Remediation task. Only for DeployIfNotExists policies, or settings you can't manage as code: in Policy → Compliance, choose Remediate, select the resources and create the task. Follow it under Remediation.
You own the compliance of the resources you deploy (Responsibilities).
Request a policy exemption¶
Use an exemption only when a resource can't comply and the risk is accepted or mitigated.
| Information | Description |
|---|---|
| Policy | Exact name or ID of the policy or initiative |
| Scope | Your subscription, a resource group, or specific resources |
| Category | Waiver (risk accepted) or Mitigated (handled another way) |
| Justification | Why it can't comply |
| Alternative measures | Which other controls reduce the risk |
| Expiry date | When it is reviewed again. Choose a short period, normally at most one year. |
| Approval | Your security officer's approval. Many organisations require it and register the exemption in their ticket system. |
An exemption on a subscription, a resource group or a resource is mirrored to the Microsoft cloud security benchmark assignment of Defender for Cloud, so that the resource also stops counting against the secure score. Allow up to 24 hours before the score changes. An exemption on a management group is not mirrored. The process on the operator side is in Policy exemptions.
Process:
- Identify the exact policy (see above).
- Collect the information in the table.
- Get approval from your security officer.
- Send the request to your platform team with the approval reference. The platform team adds the exemption as a JSON file in the configuration repository
(
policies/policy_exemptions/…), with anexpires_ondate, and reviews expiring exemptions regularly.
Exemptions are code and are reviewed: see Policy assignments. Ask your platform team whether it keeps a list of the exemptions that apply at platform level, with the reason for each.