Lesson 17 — Security Policies
Defender for Cloud recommendations are driven by the policies used to evaluate cloud resources.
This lesson explains how Azure Policy, security initiatives, assignments, parameters and compliance states work together to identify configuration gaps and enforce cloud security standards.
What you will learn
This lesson explains how security policies evaluate cloud resources and generate posture findings.
Security policy evaluation flow
Core security policy components
| Component | Purpose | Security effect |
|---|---|---|
| Policy definition | Describes the condition to evaluate and the effect to apply. | Checks whether resources meet a required control. |
| Initiative | Groups multiple policy definitions into one security baseline. | Supports consistent evaluation across many controls. |
| Assignment | Applies a definition or initiative to a scope. | Determines which resources are evaluated. |
| Scope | Defines management group, subscription, resource group or resource coverage. | Controls where the policy applies. |
| Parameters | Customise values without changing the policy definition. | Allows one definition to support different environments. |
| Effect | Controls what happens when a resource matches the condition. | Can audit, deny, modify, deploy or disable evaluation behaviour. |
| Exemption | Documents approved exclusion from policy evaluation. | Supports governed exceptions without deleting the assignment. |
| Compliance state | Shows whether the resource meets the policy requirement. | Feeds recommendations, reporting and remediation. |
Common Azure Policy effects
- Audit: identifies resources that do not meet the required condition.
- AuditIfNotExists: checks for a related configuration or dependent resource.
- Deny: blocks creation or update when the policy condition is met.
- DeployIfNotExists: deploys a required configuration when it is missing.
- Modify: changes supported properties during resource creation or update.
- Append: adds supported fields to a request.
- Disabled: turns off the policy effect while preserving the definition.
- Manual: supports controls that require evidence outside automated evaluation.
Agent Foskett investigation: “The policy existed… but it was assigned to the wrong scope.”
Key takeaways
- Defender for Cloud recommendations are closely linked to policy evaluation.
- Policy definitions describe the condition and effect.
- Initiatives group multiple controls into a security baseline.
- Assignments determine which resources are evaluated.
- Scope mistakes can create invisible compliance gaps.
- Parameters allow consistent policies with environment-specific values.
- Policy effects range from audit to deny and automated deployment.
- Compliance state should be validated after assignment changes.
- Exemptions should be approved, documented and reviewed.
- Security policies should support both posture visibility and preventative governance.
Learning objectives
After completing this lesson, you should be able to explain policy definitions, initiatives, assignments, effects and compliance states.
What is Azure Policy?
Azure Policy evaluates Azure resources against defined organisational and security requirements.
Defender for Cloud integration
Defender for Cloud uses policy evaluation to generate many security recommendations and posture findings.
Policy definition
A policy definition contains the rule used to evaluate a resource and the effect applied when conditions match.
Policy rule
The policy rule describes the logical conditions used during evaluation.
Policy effect
The effect determines whether Azure audits, blocks, modifies or deploys configuration.
Security initiative
A security initiative groups multiple policy definitions into one coordinated baseline.
Built-in initiatives
Microsoft provides built-in initiatives for security, compliance and Defender for Cloud.
Custom initiatives
Organisations can create custom initiatives for internal standards and control frameworks.
Policy assignment
An assignment applies a policy definition or initiative to a selected scope.
Management group scope
Management group assignments can provide consistent control across multiple subscriptions.
Subscription scope
Subscription assignments apply policy to resources within that subscription.
Resource group scope
Resource group assignments can target one application or environment.
Resource scope
Resource-level assignments are precise but harder to manage at scale.
Exclusions
Exclusions remove specific child scopes from an assignment.
Parameters
Parameters allow teams to customise expected values without editing the definition.
Allowed values
Allowed values restrict which parameter options may be selected.
Default values
Default values provide a standard when no specific parameter is supplied.
Audit effect
Audit records non-compliance without blocking deployment.
Deny effect
Deny prevents non-compliant resource creation or updates.
DeployIfNotExists
DeployIfNotExists can automatically add required configuration.
Modify effect
Modify can change supported resource properties during deployment.
AuditIfNotExists
AuditIfNotExists checks whether a related resource or configuration exists.
Disabled effect
Disabled preserves the policy definition but prevents enforcement or evaluation.
Compliance state
Resources may appear compliant, non-compliant, exempt, conflicting or not started.
Non-compliance reason
The non-compliance reason helps explain which condition failed.
Evaluation timing
Policy evaluation occurs during changes and through periodic compliance scans.
Manual scan
A manual scan can be triggered after major configuration changes.
Remediation task
A remediation task can apply supported deploy or modify actions to existing resources.
Managed identity
Some policy effects require a managed identity to deploy or modify resources.
Role assignment
The policy assignment identity needs appropriate permissions for remediation.
Policy drift
Changes to assignments, parameters or exclusions can weaken the intended baseline.
Scope drift
New subscriptions or resource groups may fall outside expected policy coverage.
Initiative versioning
Policy and initiative updates should be reviewed before broad rollout.
Testing
Test new deny or modify policies in a limited scope before production enforcement.
Audit first
Audit mode helps measure impact before moving to preventative enforcement.
False positives
Investigate whether a non-compliant result reflects a real control failure or policy limitation.
Not applicable
Some policies may not apply to every resource type or architecture.
Exemptions
Use formal exemptions for approved exceptions rather than removing the policy assignment.
Exemption category
Document whether the exemption is mitigated, waived or not applicable.
Expiry dates
Policy exemptions should have review or expiry dates.
Secure Score
Some policy-driven recommendations contribute to Secure Score.
Regulatory compliance
Initiatives can map policy controls to regulatory frameworks.
Custom standards
Custom initiatives can reflect internal standards not covered by built-in content.
Ownership
Assign responsibility for policy design, assignment, exception and remediation.
Change control
Policy changes should follow review and approval processes.
Reporting
Report on coverage, non-compliance, exemptions and remediation progress.
What Agent Foskett checked
Agent Foskett checked the initiative, assignment scope, exclusions, parameters and compliance results.
Best practices
- Use initiatives to manage related controls together.
- Assign policy at the highest appropriate scope.
- Review exclusions and exemptions regularly.
- Use audit before deny for new controls.
- Test parameter changes in non-production scopes.
- Validate managed identities and permissions for remediation.
- Document policy ownership.
- Monitor compliance drift.
- Review built-in policy updates.
- Confirm that new subscriptions inherit the intended baseline.
Related Agent Foskett resources
Continue learning
What are Microsoft Defender for Cloud security policies?
Microsoft Defender for Cloud security policies use Azure Policy definitions, initiatives, assignments and compliance evaluation to identify configuration gaps and generate security recommendations.
Security Policies Lesson
This Agent Foskett lesson explains Azure Policy, security initiatives, assignments, scope, parameters, effects, compliance states, remediation tasks and policy exemptions.
