azure-policy

Name: azure-policy
Author: vinayaklatthe

53installs34forks

How to install azure-policy?

vinayaklatthe/microsoft-security-skills/azure-policy

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-policy

Installs into the current project.

Summary

Guidance for Azure Policy — enforcing and auditing governance and security guardrails at scale across Azure with definitions, initiatives, assignments, and remediation tasks. Covers effects (Audit, Deny, Append, Modify, DeployIfNotExists, AuditIfNotExists), management group inher

Files · 1

View on GitHub

SKILL.md

1	# Azure Policy
2
3	Azure Policy enforces organisational standards and assesses compliance at scale, auditing or
4	preventing non-compliant resource configurations and remediating drift automatically. It's the
5	preventive control plane for an Azure estate and the engine behind Defender for Cloud
6	regulatory compliance.
7
8	## When to use
9	Implementing preventive and detective governance / security guardrails across subscriptions
10	and management groups. Use this skill to pick effects, design initiatives, and roll out safely.
11
12	Do not use this skill for RBAC role choice (`azure-role-selector`), Defender posture
13	(`defender-for-cloud-hardening`), or Bicep / IaC templating.
14
15	## Pick the policy effect by goal
16
17	\| Goal \| Effect \| Notes \|
18	\|---\|---\|---\|
19	\| Surface non-compliant resources without blocking \| Audit \| Reporting only; default starting point \|
20	\| Block creation / update of non-compliant resources \| Deny \| Preventive; test in Audit first \|
21	\| Add a required tag / property automatically \| Modify (or `Append`) \| Mutates the request \|
22	\| Deploy a missing related resource (e.g. diagnostic settings) \| DeployIfNotExists (DINE) \| Managed identity required \|
23	\| Surface a missing related resource \| AuditIfNotExists (AINE) \| Reporting only \|
24	\| Conditional logic across many resources \| Initiative \| Group multiple policies \|
25	\| Block guest user creation / specific SKUs \| Deny + parameter \| Parameterise allowed SKUs \|
26	\| Enforce Defender for Cloud baseline \| Built-in MCSB initiative \| Don't author your own \|
27
28	> Rule of thumb: start with Audit on every new policy for 14-30 days. Review
29	> compliance. Move critical controls to Deny. Use DeployIfNotExists for things
30	> that should "just be there" (diagnostic settings, defender agents). Never start with Deny
31	> tenant-wide.
32
33	## Approach
34
35	1. Use built-in initiatives where they exist — **Microsoft Cloud Security Benchmark
36	(MCSB)** is the default. Add regulatory initiatives (CIS, ISO 27001, NIST 800-53, PCI
37	DSS, HIPAA) per compliance scope.
38	*Verify: MCSB initiative assigned at root management group; compliance state visible in
39	Defender for Cloud.*
40
41	2. Author custom definitions only where built-ins don't exist — Custom policy as ARM
42	JSON: `policyRule` (condition + effect), `parameters` (reusable inputs), `metadata`
43	(category). Keep policies single-purpose; group via initiatives.
44
45	3. Initiatives = grouped policies — Bundle related policies (e.g. "Enterprise security
46	baseline" initiative containing 30 policies). Assign initiatives, not individual policies,
47	for manageability.
48
49	4. Scope at management group — Assign at management group for inheritance across
50	child subscriptions. Use exclusions sparingly with documented justification.
51	Verify: assignment scope visible in policy compliance; child subscriptions inherit.
52
53	5. Roll out: Audit → review → Deny — Assign as Audit first. Wait 14-30 days, pull
54	non-compliance list, work with workload owners to remediate or document exceptions. Then
55	switch the assignment to Deny.
56	*Verify: non-compliance count down to acceptable baseline before the Deny switch;
57	workload owners notified.*
58
59	6. Remediate existing resources with remediation tasks — `DeployIfNotExists` and
60	`Modify` policies only act on new / updated resources. Use remediation tasks to bring
61	existing resources into compliance. The policy assignment's managed identity performs
62	the change.
63	Verify: remediation task created post-assignment; success rate > 95%; failures triaged.
64
65	7. Monitor + integrate with Defender for Cloud — Compliance state is the daily dashboard.
66	Defender for Cloud uses policies for its recommendations - failing recommendation = failing
67	policy.
68
69	## Guardrails
70	- **Test Deny policies in audit first - a broad Deny can block legitimate deployments and
71	pipelines.** First Deny at midnight = production deployment blocked at 09:00.
72	- Use parameters to make policies reusable across environments. Hard-coded regions / SKUs
73	/ t

People who liked this also viewed

6 picks

Type

azure-policy

53installs34forks

View on GitHub

How to install azure-policy?

vinayaklatthe/microsoft-security-skills/azure-policy

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-policy

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Azure Policy
2
3	Azure Policy enforces organisational standards and assesses compliance at scale, auditing or
4	preventing non-compliant resource configurations and remediating drift automatically. It's the
5	preventive control plane for an Azure estate and the engine behind Defender for Cloud
6	regulatory compliance.
7
8	## When to use
9	Implementing preventive and detective governance / security guardrails across subscriptions
10	and management groups. Use this skill to pick effects, design initiatives, and roll out safely.
11
12	Do not use this skill for RBAC role choice (`azure-role-selector`), Defender posture
13	(`defender-for-cloud-hardening`), or Bicep / IaC templating.
14
15	## Pick the policy effect by goal
16
17	\| Goal \| Effect \| Notes \|
18	\|---\|---\|---\|
19	\| Surface non-compliant resources without blocking \| Audit \| Reporting only; default starting point \|
20	\| Block creation / update of non-compliant resources \| Deny \| Preventive; test in Audit first \|
21	\| Add a required tag / property automatically \| Modify (or `Append`) \| Mutates the request \|
22	\| Deploy a missing related resource (e.g. diagnostic settings) \| DeployIfNotExists (DINE) \| Managed identity required \|
23	\| Surface a missing related resource \| AuditIfNotExists (AINE) \| Reporting only \|
24	\| Conditional logic across many resources \| Initiative \| Group multiple policies \|
25	\| Block guest user creation / specific SKUs \| Deny + parameter \| Parameterise allowed SKUs \|
26	\| Enforce Defender for Cloud baseline \| Built-in MCSB initiative \| Don't author your own \|
27
28	> Rule of thumb: start with Audit on every new policy for 14-30 days. Review
29	> compliance. Move critical controls to Deny. Use DeployIfNotExists for things
30	> that should "just be there" (diagnostic settings, defender agents). Never start with Deny
31	> tenant-wide.
32
33	## Approach
34
35	1. Use built-in initiatives where they exist — **Microsoft Cloud Security Benchmark
36	(MCSB)** is the default. Add regulatory initiatives (CIS, ISO 27001, NIST 800-53, PCI
37	DSS, HIPAA) per compliance scope.
38	*Verify: MCSB initiative assigned at root management group; compliance state visible in
39	Defender for Cloud.*
40
41	2. Author custom definitions only where built-ins don't exist — Custom policy as ARM
42	JSON: `policyRule` (condition + effect), `parameters` (reusable inputs), `metadata`
43	(category). Keep policies single-purpose; group via initiatives.
44
45	3. Initiatives = grouped policies — Bundle related policies (e.g. "Enterprise security
46	baseline" initiative containing 30 policies). Assign initiatives, not individual policies,
47	for manageability.
48
49	4. Scope at management group — Assign at management group for inheritance across
50	child subscriptions. Use exclusions sparingly with documented justification.
51	Verify: assignment scope visible in policy compliance; child subscriptions inherit.
52
53	5. Roll out: Audit → review → Deny — Assign as Audit first. Wait 14-30 days, pull
54	non-compliance list, work with workload owners to remediate or document exceptions. Then
55	switch the assignment to Deny.
56	*Verify: non-compliance count down to acceptable baseline before the Deny switch;
57	workload owners notified.*
58
59	6. Remediate existing resources with remediation tasks — `DeployIfNotExists` and
60	`Modify` policies only act on new / updated resources. Use remediation tasks to bring
61	existing resources into compliance. The policy assignment's managed identity performs
62	the change.
63	Verify: remediation task created post-assignment; success rate > 95%; failures triaged.
64
65	7. Monitor + integrate with Defender for Cloud — Compliance state is the daily dashboard.
66	Defender for Cloud uses policies for its recommendations - failing recommendation = failing
67	policy.
68
69	## Guardrails
70	- **Test Deny policies in audit first - a broad Deny can block legitimate deployments and
71	pipelines.** First Deny at midnight = production deployment blocked at 09:00.
72	- Use parameters to make policies reusable across environments. Hard-coded regions / SKUs
73	/ t

People who liked this also viewed

6 picks

Type