> For the complete documentation index, see [llms.txt](https://ghoulsec.gitbook.io/ghoulsec-vault/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ghoulsec.gitbook.io/ghoulsec-vault/exam-prep-notes/az-900/azure-policies-and-blueprints.md).
# Azure policies & Blueprints
#### **Azure Policy Overview**
Azure Policy is a service in Microsoft Azure used for **resource governance, security, compliance, and cost management**. It helps organizations **enforce rules and standards** across their Azure environment by defining, assigning, and evaluating policies at different levels of Azure resources.
***
### **1. Policy Definitions**
A **policy definition** is a rule that enforces specific conditions on Azure resources. It consists of:
* **Conditions**: The criteria that determine compliance (e.g., resources must be in a specific region).
* **Effect**: The action taken when a condition is met (e.g., deny, audit, modify).
#### Example JSON Structure of a Policy Definition:
```json
{
"mode": "All",
"policyRule": {
"if": {
"field": "location",
"notIn": ["East US", "West Europe"]
},
"then": {
"effect": "deny"
}
}
}
```
This policy denies the creation of resources outside **East US** or **West Europe**.
***
### **2. Assigning Policies to Azure Scope**
Azure Policy can be assigned at different **scopes**, including:
* **Management Group** (applies policies across multiple subscriptions)
* **Subscription** (affects all resources in the subscription)
* **Resource Group** (only applies to resources within the group)
* **Individual Resources**
> **Scope Hierarchy**: Management Group > Subscription > Resource Group > Resource
Example: A policy assigned at the **Subscription level** applies to all resource groups and resources within it.
***
### **3. Types of Policies**
#### **a) Single Policy**
A single policy definition enforces a specific rule, like requiring **tagging of resources** or enforcing a **naming convention**.
#### **b) Policy Initiatives (Policy Set)**
A **policy initiative** is a collection of multiple policy definitions grouped together to enforce broader compliance requirements.
Example:
* **Security Initiative**: Ensures encryption, network security, and identity compliance.
* **Cost Management Initiative**: Restricts resource sizes and enforces tagging for cost tracking.
***
### **Example: Location-Based Access Policy**
A **location-based access policy** ensures that Azure resources can only be deployed in approved regions.
#### **Use Case:**
An organization wants to ensure that all resources are deployed only in **East US** and **West Europe** for compliance reasons.
#### **Implementation Steps:**
1. **Create Policy Definition**: Define the rule to allow only specific locations.
2. **Assign Policy**: Apply the policy at the **Subscription or Resource Group** level.
3. **Monitor Compliance**: View non-compliant resources in **Azure Policy Compliance Dashboard**.
#### **Policy Definition Example:**
```json
{
"properties": {
"displayName": "Restrict resource location",
"policyRule": {
"if": {
"field": "location",
"notIn": ["East US", "West Europe"]
},
"then": {
"effect": "deny"
}
}
}
}
```
📌 **Effect:** Any resource deployment outside East US or West Europe will be denied.
***
## Azure Blueprints
Azure Blueprints is a **governance and deployment framework** that enables organizations to define and replicate Azure environments consistently. It acts as a **package of pre-approved templates** that streamline resource provisioning while maintaining compliance.
### **Key Concepts**
#### **1. Blueprint Definition**
A **Blueprint Definition** is a reusable package that describes what should be deployed. It includes various **artifacts** such as:
* **Resource Groups** – Logical grouping of resources.
* **ARM Templates** – Infrastructure-as-Code for resource deployment.
* **Policy Assignments** – Enforce compliance and security standards.
* **Role Assignments** – Define access control for users and services.
#### **2. Blueprint Assignment**
A **Blueprint Assignment** deploys the defined blueprint to a specific **Azure subscription**, ensuring consistent resource provisioning and governance. This replicates an approved environment with minimal manual effort.
#### **3. Key Benefits**
✅ **Standardized Deployments** – Ensures consistent infrastructure across multiple environments.\
✅ **Governance & Compliance** – Enforces security policies and access controls.\
✅ **Automation & Efficiency** – Simplifies the provisioning of complex environments.\
✅ **Centralized Storage** – Stores approved templates for organizational use.
#### **Use Case**
An enterprise can use Azure Blueprints to deploy a **fully configured environment** with predefined **networks, security policies, and role-based access**, ensuring compliance across all subscriptions.
