Azure Policy and resource locks
Governance keeps resources and data in line with your organisation's rules and with regulations. The skills outline names three tools: Azure Policy and resource locks, in this lesson, and Microsoft Purview, in the next one. Policy and locks govern your resources; Purview governs your data.
Azure Policy
Azure Policy creates, assigns and manages policies that enforce rules on your resources, so they stay compliant with your standards.
- A policy definition describes a rule, for example allowed locations, allowed VM sizes or require a tag. Many are built in, for storage, networking, compute, security and monitoring; you can also write your own.
- An initiative is a group of related policies assigned together, for example everything needed for a compliance standard, or the security baseline that Microsoft Defender for Cloud uses.
- Policies are assigned at a scope (management group, subscription or resource group) and inherited below it.
What policies can do:
- Deny non-compliant resources from being created,
- Audit and report resources that do not comply,
- Modify or remediate resources automatically, such as adding a missing tag, or deploying a missing setting.
Policies evaluate existing resources too, so you can see which ones are out of compliance and fix them. Because Azure Policy works through Resource Manager, it applies whichever tool someone uses to create a resource. Through Azure Arc it can govern servers and Kubernetes clusters outside Azure as well.
Resource locks
A resource lock prevents resources from being accidentally deleted or changed, even by people who have permission to do so.
| Lock | Read | Modify | Delete |
|---|---|---|---|
| Delete (CanNotDelete) | yes | yes | no |
| ReadOnly | yes | no | no |
- Locks can be applied to a subscription, resource group or resource, and are inherited.
- Locks apply to everyone, including Owners. To delete a locked resource, someone must remove the lock first, which requires the right permissions (such as Owner or User Access Administrator).
- Locks protect the resource in Azure's management plane, not the data inside it: a ReadOnly lock on a storage account stops changes to the account's settings, not necessarily to the blobs stored in it.