Manage Azure Identities and Governance · Topic 3 of 4
Azure Policy, Locks and Tags
AZ-104 governance: Azure Policy definitions, initiatives, effects and remediation, resource locks, tags and tag inheritance, and how policy differs from RBAC.
- 5 min
- Definition is the rule, initiative is a group of rules, assignment applies them to a scope.
- Deny blocks, Audit reports, Modify and Append change, DeployIfNotExists adds a resource.
- Existing resources need a remediation task and a managed identity with enough permissions.
What it is
Three tools keep an Azure environment consistent. Azure Policy sets rules for how resources must be configured. Resource locks stop accidental changes and deletion. Tags label resources so that you can find and charge for them.
They answer different questions, and the exam often puts them side by side.
How it works
Azure Policy
A policy definition is one rule, written in JSON, such as "allowed locations" or "require a tag". An initiative groups related definitions so that they can be assigned together. A policy assignment applies a definition or initiative to a scope, and you can exclude chosen resources from it. Settings assigned at a higher scope reach everything beneath.
The effect decides what happens when a resource does not comply.
| Effect | What it does |
|---|---|
| Deny | Blocks the request that would create or change a non-compliant resource |
| Audit | Allows it and records it as non-compliant |
| Append | Adds fields to the request, such as a tag |
| Modify | Adds, updates or removes properties or tags on resources |
| DeployIfNotExists | Deploys a related resource, such as an extension, if it is missing |
| AuditIfNotExists | Reports when a related resource is missing |
| Disabled | Turns the rule off |
New and changed resources are checked as they are created. Existing resources are evaluated on a regular cycle, about every 24 hours, and you can start a scan on demand.
Remediation and exemptions
A policy with the DeployIfNotExists or Modify effect does not change resources that already exist. To fix those, you create a remediation task. It runs with a managed identity, which must hold a role with enough permission to make the change.
An exemption excludes a resource or scope from a policy, with a reason and an optional expiry date.
Policy compared with RBAC
RBAC controls what a user is allowed to do. Policy controls what a resource is allowed to look like. A user with Owner can still be blocked by a Deny policy.
Resource locks
A lock protects a resource from accidents.
| Lock | Effect |
|---|---|
| CanNotDelete | Users can read and change the resource but cannot delete it |
| ReadOnly | Users can only read the resource. It cannot be changed or deleted |
A lock can be set on a subscription, resource group or resource, and child resources inherit it. It applies to every user, including Owners. To delete a locked resource you must first remove the lock, which needs the right to manage locks, held by Owner and User Access Administrator.
Tags
A tag is a name and value pair, such as CostCenter equals 4021. Each resource, resource group and subscription can hold up to 50 tags. Tag names are not case sensitive but values are.
Tags are not inherited. A tag on a resource group does not appear on the resources in it. To copy a tag down you use a policy with the Modify effect, such as the built-in policy that inherits a tag from the resource group. A tag on its own does not restrict anything. A policy can require a tag by denying resources that lack it.
Built-in policy examples
Azure ships many built-in definitions. These come up often.
- Allowed locations: denies resources outside chosen regions.
- Allowed virtual machine size SKUs: denies sizes that are not on the list.
- Require a tag on resources: denies new resources that lack a named tag.
- Inherit a tag from the resource group: a Modify policy that copies a tag down to resources.
Definitions take parameters, so one definition can serve many assignments. You can also exclude chosen resource groups or resources from an assignment.
Choosing the right control
| The requirement | Use |
|---|---|
| Only allow resources in West Europe | Azure Policy, Allowed locations |
| Nobody may delete the production database, even an Owner | A CanNotDelete lock |
| An engineer may restart virtual machines but not delete them | An RBAC role |
| Every resource must carry a CostCenter tag | Azure Policy, Require a tag |
| Copy the CostCenter tag from the group to its resources | A Modify policy, then a remediation task for existing resources |
Tags and cost
Tags let Cost Management group spending by department, project or environment. Cost Management can also apply tag inheritance, which takes the tags of a resource group or subscription and applies them to the usage records of the resources inside, without editing each resource.
How the exam asks about this
- "Block creation of non-compliant resources." Deny.
- "Report non-compliance but allow the resource." Audit.
- "Fix resources that already exist." A remediation task.
- "Stop deletion by every user." A CanNotDelete lock.
- A lock applied to a resource group is inherited by the resources inside it.
What to remember for the exam
- Definition is the rule, initiative is a group of rules, assignment applies them to a scope.
- Deny blocks, Audit reports, Modify and Append change, DeployIfNotExists adds a resource.
- Existing resources need a remediation task and a managed identity with enough permissions.
- Locks: CanNotDelete blocks delete, ReadOnly blocks change and delete. They apply to Owners too.
- Tags are not inherited. A Modify policy can copy them down.
- Up to 50 tags per resource, resource group or subscription.
"Existing resources must also be fixed" points to a remediation task. "Even Owners must not delete it" points to a lock.
Common mistakes
Using a lock to enforce a standard. A lock stops change. It does not check configuration. That is Policy.
Expecting a new policy to fix existing resources. Only a remediation task changes them.
Assuming Owners are exempt from locks. The lock must be removed first.
Expecting a tag on a resource group to reach its resources. Tags are not inherited without a policy.
Check yourself
Which effect blocks the creation of a non-compliant resource?
Deny.
What do you create to bring existing resources into compliance with a Modify policy?
A remediation task.
Does a tag applied to a resource group appear on its resources automatically?
No, tags are not inherited unless a policy copies them.
Topic 3 of 4 in Manage Azure Identities and Governance
Test yourself on Manage Azure Identities and Governance
The full Microsoft AZ-104 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.