Azure Policy CLI (az policy) — Reference Guide

What is Azure Policy?

Azure Policy is a governance service that lets you create, assign, and enforce rules over your Azure resources. It helps ensure resources stay compliant with your organization’s standards — for example, enforcing tags, restricting VM sizes, or requiring encryption.

Think of it like a rulebook for your Azure environment:

• Policy Definition → a single rule (e.g., “All storage accounts must be encrypted”)
• Initiative (Policy Set) → a collection of related rules grouped together (e.g., “Security Baseline”)
• Assignment → applying a policy/initiative to a specific scope (subscription, resource group, etc.)

---

1. Policy Definitions

A policy definition describes what to check and what to do if a resource doesn’t comply.

List existing policy definitions

az policy definition list --query "[].{Name:name, DisplayName:displayName}" -o table

Show a specific built-in policy

az policy definition show --name "febd0533-8e55-448f-b837-bd0e06f16469"

Built-in policies are identified by a GUID or friendly name.

Create a custom policy definition

Step 1 — Define the rule (policy-rules.json):

{
  "if": {
    "field": "tags['Environment']",
    "exists": "false"
  },
  "then": {
    "effect": "deny"
  }
}

Step 2 — Create the definition:

az policy definition create \
  --name "require-environment-tag" \
  --display-name "Require Environment tag on resources" \
  --description "Denies resource creation if the Environment tag is missing" \
  --rules "policy-rules.json" \
  --mode Indexed

Example explained:

• --mode Indexed → only applies to resource types that support tags/location
• effect: deny → blocks the resource creation if the tag is missing

---

2. Policy Initiatives (Grouping Policies)

An initiative bundles multiple policy definitions into one manageable unit — useful for compliance standards like “CIS Benchmark” or “ISO 27001.”

Step 1 — Define grouped policies (initiative-definitions.json):

[
  {
    "policyDefinitionId": "/subscriptions/<sub-id>/providers/Microsoft.Authorization/policyDefinitions/require-environment-tag"
  },
  {
    "policyDefinitionId": "/subscriptions/<sub-id>/providers/Microsoft.Authorization/policyDefinitions/deny-public-ip"
  }
]

Step 2 — Create the initiative:

az policy set-definition create \
  --name "security-baseline" \
  --display-name "Security Baseline Initiative" \
  --definitions "initiative-definitions.json"

---

3. Policy Assignments

Assigning is how a definition or initiative actually starts enforcing rules at a given scope.

Assign at subscription level

az policy assignment create \
  --name "enforce-env-tag" \
  --policy "require-environment-tag" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

Assign at resource group level

az policy assignment create \
  --name "enforce-env-tag-rg" \
  --policy "require-environment-tag" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demo-rg"

Assign an initiative

az policy assignment create \
  --name "security-baseline-assignment" \
  --policy-set-definition "security-baseline" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000"

Example scenario:

creates a new VM in demo-rg without an Environment tag. Because the enforce-env-tag-rg assignment is active, Azure Policy denies the deployment and returns an error explaining the missing tag.

---

4. Checking Compliance

Once assigned, policies continuously evaluate resources for compliance.

# List compliance state for a resource group
az policy state list --resource-group "demo-rg" -o table

# Get a compliance summary
az policy state summarize --resource-group "demo-rg"

Example output (conceptual):

Resource	Policy	Compliance State
vm-01	require-environment-tag	NonCompliant
storage-01	require-environment-tag	Compliant

---

5. Remediation

Some policies (with DeployIfNotExists or Modify effects) can automatically fix non-compliant resources.

az policy remediation create \
  --name "remediate-missing-tags" \
  --policy-assignment "enforce-env-tag-rg"

# Check remediation task status
az policy remediation list --resource-group "demo-rg" -o table

---

6. Exemptions

Sometimes a resource legitimately needs to bypass a policy (e.g., a test resource).

az policy exemption create \
  --name "temp-test-exemption" \
  --policy-assignment "enforce-env-tag-rg" \
  --exemption-category "Waiver" \
  --scope "/subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/demo-rg/providers/Microsoft.Compute/virtualMachines/test-vm"

---

Key Concepts

Term	Purpose	Example
Definition	Single rule	“Deny VMs without tags”
Initiative	Group of rules	“Security Baseline”
Assignment	Apply rule(s) to a scope	Assign at subscription/RG level
Effect	Action taken on non-compliance	Deny, Audit, Modify, DeployIfNotExists, Disabled
Scope	Where the policy applies	Management Group → Subscription → Resource Group → Resource
Compliance State	Evaluation result	Compliant / NonCompliant
Remediation	Auto-fix non-compliant resources	Adds missing tags automatically
Exemption	Bypass a policy for specific resources	Temporary waiver for test resources

---

Common Effects

Effect	Behavior
Deny	Blocks the resource creation/update entirely
Audit	Allows the action but flags it as non-compliant in reports
Append	Adds fields/tags to the resource before creation
Modify	Adds, updates, or removes properties on existing resources
DeployIfNotExists	Automatically deploys a related resource if missing (e.g., enabling diagnostic logs)
Disabled	Turns off the policy without deleting it

---

Quick Reference — Command Cheat Sheet

# Definitions
az policy definition list
az policy definition create --name <n> --rules <file> --mode Indexed
az policy definition delete --name <n>

# Initiatives
az policy set-definition list
az policy set-definition create --name <n> --definitions <file>

# Assignments
az policy assignment create --name <n> --policy <policy-name> --scope <scope>
az policy assignment list
az policy assignment delete --name <n>

# Compliance
az policy state list --resource-group <rg>
az policy state summarize --resource-group <rg>

# Remediation
az policy remediation create --name <n> --policy-assignment <assignment-name>
az policy remediation list

# Exemptions
az policy exemption create --name <n> --policy-assignment <assignment-name> --exemption-category Waiver --scope <scope>