Design identity, governance, and monitoring solutions · Topic 6 of 6
Compliance and Identity Governance
AZ-305 compliance design: Azure Policy effects and initiatives, Defender for Cloud and Purview, and Entra entitlement management with access reviews.
- 4 min
- Policy effects: audit and auditIfNotExists never block, deny blocks, modify and deployIfNotExists can be remediated. Start in audit.
- Policy governs resource properties. RBAC governs who can act.
- Defender for Cloud gives secure score and regulatory compliance. Purview classifies and labels data.
What it is
Governance has two halves. Resource governance and compliance make sure Azure resources follow rules, using Azure Policy, Microsoft Defender for Cloud and Microsoft Purview. Identity governance makes sure the right people keep the right access, using Microsoft Entra ID Governance: entitlement management, access reviews and lifecycle workflows.
How it works
Azure Policy
A policy definition describes a rule and an effect. A policy initiative groups definitions. An assignment applies them at a scope and inherits downward, with optional exclusions.
| Effect | Behaviour |
|---|---|
| Audit | Records noncompliance, never blocks |
| AuditIfNotExists | Audits when a related resource is missing |
| Deny | Blocks creation or change of a noncompliant resource |
| Append and Modify | Add or change properties or tags at create or update. Modify can be remediated for existing resources |
| DeployIfNotExists | Deploys a template when a related resource is missing. Needs a managed identity with enough permission, and can be remediated |
| Disabled | Turns the definition off |
Order of evaluation: disabled, then append and modify, then deny, then audit effects. Only modify and deployIfNotExists support remediation tasks for existing resources. Microsoft recommends starting new policies in audit, reviewing the results, then moving to deny or modify. Examples: deny a resource name that does not match a pattern, require encryption on storage, allow only approved regions and VM sizes, inherit tags.
Policy is about resource properties. Azure RBAC is about who can act. Do not use policy to grant permissions.
Managing compliance
| Tool | Role |
|---|---|
| Azure Policy compliance | Per resource and per initiative state, such as the Microsoft cloud security benchmark |
| Microsoft Defender for Cloud | Secure score, recommendations and regulatory compliance dashboards (ISO 27001, PCI DSS, NIST and others), with CSPM across Azure, AWS and GCP |
| Microsoft Purview | Data governance: data catalog, classification, sensitivity labels, data loss prevention and Compliance Manager assessments |
| Service Trust Portal | Microsoft's audit reports and certifications |
| Resource locks and Azure Policy exemptions | Controlled exceptions |
For data residency, use an allowed locations policy. For sovereignty needs, Azure confidential computing and sovereign controls apply to specific workloads.
Identity governance
Microsoft Entra ID Governance (licensed separately or with P2 features) provides:
| Feature | Purpose |
|---|---|
| Entitlement management | Access packages bundle groups, apps and sites, with an approval workflow and an expiry. External users can request packages, and the guest account can be removed when access ends |
| Access reviews | Periodic recertification of group membership, app access, guest users and privileged roles, by managers or the users themselves. Can auto remove access |
| Lifecycle workflows | Automate joiner, mover and leaver tasks |
| Privileged Identity Management | Just in time privileged access |
| Terms of use and Conditional Access | Consent and access conditions |
Use entitlement management for partner and project access that should end automatically. Use access reviews for recurring audits, such as quarterly review of all guest users. Use PIM for administrators. Together they meet the "least privilege and regular recertification" requirements of audits.
Choosing quickly
| Requirement | Answer |
|---|---|
| Block resources created outside approved regions | Azure Policy deny, allowed locations |
| Add a missing tag at creation and fix existing resources | Policy modify with remediation |
| Deploy diagnostics settings to every new resource automatically | Policy deployIfNotExists |
| Show compliance against PCI DSS | Defender for Cloud regulatory compliance |
| External partners get access that expires | Entitlement management access packages |
| Quarterly review of who has access | Access reviews |
| Classify and label documents and data | Microsoft Purview |
A worked scenario
A bank must prove compliance with PCI DSS, keep data in two regions, and control partner access. The architect assigns an initiative at the production management group that denies other regions, audits encryption gaps and uses deployIfNotExists to turn on diagnostic settings. Defender for Cloud shows the PCI DSS dashboard. Partners request access packages that expire after 90 days, and a quarterly access review recertifies guests and Owners.
What to remember for the exam
- Policy effects: audit and auditIfNotExists never block, deny blocks, modify and deployIfNotExists can be remediated. Start in audit.
- Policy governs resource properties. RBAC governs who can act.
- Defender for Cloud gives secure score and regulatory compliance. Purview classifies and labels data.
- Entitlement management uses access packages with approval and expiry. Access reviews recertify access.
- Use initiatives and management groups to apply policy at scale.
"Fix existing resources too" means a remediation task, which only modify and deployIfNotExists support.
How the exam asks about this
- "Prevent resources from being created outside West Europe." A deny policy on allowed locations.
- "Automatically enable diagnostics on every new storage account." A deployIfNotExists policy.
- "Show the organization's PCI DSS compliance posture." Defender for Cloud regulatory compliance.
- "Remove guest access automatically after the project ends." Entitlement management access packages with expiry.
Common mistakes
Starting with deny. Audit first to avoid outages.
Expecting audit to enforce. It only reports.
Forgetting the managed identity for deployIfNotExists.
Using Policy to grant access. Use RBAC.
Check yourself
Which effects support remediation of existing resources?
Modify and deployIfNotExists.
Which feature gives partners time limited access with approval?
Entitlement management access packages.
Which tool shows regulatory compliance dashboards?
Microsoft Defender for Cloud.
Topic 6 of 6 in Design identity, governance, and monitoring solutions
Test yourself on Design identity, governance, and monitoring solutions
The full Microsoft AZ-305 question bank has 755 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.