--- title: "Regain Control of Azure Resources with Azure Policy" description: "Master Azure Policy through GUI and command-line to take back control of your Azure resources." canonical: "https://adamtheautomator.com/azure-policy/" --- # Regain Control of Azure Resources with Azure Policy > Master Azure Policy through GUI and command-line to take back control of your Azure resources. Source: https://adamtheautomator.com/azure-policy/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![Regain Control of Azure Resources with Azure Policy](https://adamtheautomator.com/wp-content/uploads/2019/08/photo-1450101499163-c8848c66ca85.jpg) # Regain Control of Azure Resources with Azure Policy [![](https://secure.gravatar.com/avatar/d0b9d42e21e5622713f8b693aa5c0f9244d5f7dd200ed29b8398f52dee5de337?s=192&d=mm&r=g)Adam Bertram](https://adamtheautomator.com/author/adam-bertram/)3 August 20195 min. read Categories: [Cloud](/category/cloud/) Tags:[Microsoft Azure](/tag/microsoft-azure/) Table of Contents * [Creating an Azure Policy](#creating-a-policy) * [Azure Portal](#azure-portal) * [PowerShell](#powershell) * [Azure CLI](#azure-cli) * [Azure Policy Templates](#templates) * [How Azure Policy Assignment Works](#how-policy-assignment-works) * [Example Azure Policies](#example-policies) * [How to Make Azure Policies more Reusable](#how-to-make-policies-more-reusable) * [Parameters](#parameters) * [Initiatives](#initiatives) * [Initiative Parameters](#initiative-parameters) * [Remediation Tasks](#remediation-tasks) * [Azure Portal](#azure-portal-1) * [PowerShell](#powershell-1) * [Azure CLI](#azure-cli-1) * [Summary](#summary) A common theme in cloud environments today is the ability to define templates, policies, and procedures. These templates then dictate what can be done and verify that what does exist is correct. A service from Microsoft called Azure Policy is a great way to make that happen. Not a reader? Watch this related video tutorial! **_Not seeing the video? Make sure your ad blocker is disabled._** In this article, you will learn how Azure Policy works and then see how to create various policies and remediate actions. ## Creating an Azure Policy There are many ways to create policies such as via the Azure Portal Portal, PowerShell, Azure CLI and ARM templates. ### Azure Portal If you prefer the GUI route or are exploring your options, starting here is a good introduction into policies. The interface is simple and allows you to see what your options are at a glance. 1. Within the [Azure Portal](https://portal.azure.com)_, s_earch for _Policy_. 2. Click on _Assignments_ under the _Authoring_ section 3. Click on _Assign policy_ 4. Click on the ellipsis under _Scope_ to select the subscription to apply to and optionally the resource group 5. Click on the ellipsis under _Policy definition_ to select the policy to define 6. Either use the default generated name under _Assignment n_ame or enter one to uniquely identify your policy 7. Fill out any parameters as necessary based on the policy chosen 8. Finally create a _managed identity a_nd define its location if necessary ![Creating a Policy](/wp-content/uploads/2019/08/image-13.png) Creating a Policy ### PowerShell Thankfully PowerShell makes it quick and easy to assign an Azure policy definition to a policy assignment. There are two prerequisites, which is needing the latest version of Azure PowerShell installed and registering the Azure Policy Insights resource provider. ```powershell PS51> Register-AzResourceProvider -ProviderNamespace 'Microsoft.PolicyInsights' ``` Assign the Policy ```powershell PS51> $resourceGroup = Get-AzResourceGroup -Name '' PS51> $definition = Get-AzPolicyDefinition | Where-Object { $_.Properties.DisplayName -eq '' } PS51> New-AzPolicyAssignment -Name '' -DisplayName '' -Scope $resourceGroup.ResourceId -PolicyDefinition $definition -listOfResourceTypesAllowed '' ``` ### Azure CLI If PowerShell isn’t available or not preferred, then using the Azure CLI also allows you to accomplish much of the same. This can also be helpful in cross-platform scenarios if you are unable to use PowerShell on all operating systems. ```bash > az policy assignment create --name '' --display-name '' --scope '' --policy '' ``` ### Azure Policy Templates Azure Resource Manager templates are yet another way to create and assign policies to resources. Below is a starter template that you can use to choose a policy to assign to a resource group as an example. ```json { "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", "contentVersion": "1.0.0.0", "parameters": { "policyAssignmentName": { "type": "string", "metadata": { "description": "Specifies the name of the policy assignment." } }, "rgName":{ "type": "string", "defaultValue": "[resourceGroup().name]", "metadata": { "description": "Specifies the name of the resource group where you want to assign the policy." } }, "policyDefinitionID": { "type": "string", "metadata": { "description": "Specifies the ID of the policy definition or policy set definition being assigned." } } }, "resources": [ { "type": "Microsoft.Authorization/policyAssignments", "name": "[parameters('policyAssignmentName')]", "apiVersion": "2018-05-01", "properties": { "scope": "[concat (subscription ( ).id, '/resourceGroups/', parameters('rgName'))]", ``` ## How Azure Policy Assignment Works After choosing or creating the policy definitions that you want to apply, assign those definitions to affect a specific scope. The scope merely defines what the policy assignment is going to apply to, such as a management or resource group. Something to note is that policy assignment are inherited by all child resources, but you do have the ability to exclude a sub-scope if required. ## Example Azure Policies There are a lot of policy definitions out there and it can be hard to decide what is best to apply. So what are some of the options, when might you use them and why? * **Require Tag and its Value** – This can be used for any number of ways, but one possibility is for say cost codes, or for identifying a number of different resources spread across multiple resource groups. * **Allowed Resource Types** – What if you only want to allow specific resources? This can enforce that, with say just the ability to create a storage resource. * **Audit Windows VMs with a [Pending Reboot](https://adamtheautomator.com/pending-reboot-registry/ "Pending Reboot")** – Perhaps you want to know what Windows VMs require a pending reboot, to make sure those don’t get left behind? Use this policy to find and possibly remediate those on a schedule. * **Audit Diagnostic Setting** – If diagnostic settings are not enabled then this policy will find those that are non-compliant. * **Management Ports Should be Closed on your Virtual Machines –** Verify that the management ports on your VMs are closed, a great policy for the security-minded. * **Deprecated Accounts Should be Removed from your Subscription** – For all accounts that have been blocked from sign-in within a directory, find those to potentially remediate as necessary. Although there are many here, and even more being created every day, you also have a very powerful ability to create your own custom policy definitions. Using a simple query definition schema you can create powerful if-then constructions to define what you want to apply policies to. ## How to Make Azure Policies more Reusable ### Parameters One of the most useful tools are defining parameters for use in your policies. If you had to define a unique policy for each and every variation in a policy, you may end up with hundreds. A great solution to this is to parameterize a policy. With this you can customize the policy at the time of assignment and make one policy definition apply to many different use cases. ### Initiatives The next logical step is to collect multiple definitions together in a set. This allows you to assign all those different definitions to a scope without having to individually assign each one over and over. ### Initiative Parameters Finally, you can add parameters to initiatives that can be inherited down to the individual policies. This means that you don’t have to individually assign parameters for each policy contained within an initiative. This can save a ton of time as you can define only a few initiatives that apply many different policies in several different ways depending on the parameters chosen. ## Remediation Tasks So what do you do when you have a policy that evaluates but finds resources out of compliance? At that point, you can launch a remediation task to fix whatever the issue might be. This can be quite powerful but also quite dangerous if setup incorrectly. Once again there are several ways to define these tasks either through the Azure Portal, PowerShell or through the Azure CLI. ### Azure Portal As before you can use the Azure Portal to explore the creation of a remediation task. If you find that there are no policies listed, make sure you have both _deployIfNotExists_ policies and also those that have evaluated to _non-compliant_ otherwise they will not show. 1. Within the Azure Portal, search for _Policy_ 2. Click on _Remediation_ on the left-hand side 3. Click on a policy that is of the type of _deployIfNotExists an_d has _non-compliant_ resources 4. Filter the resources to be re-mediated on the _New remediation_ task page to limit what the task applies to 5. Click on _Remediate_ to start the task itself ### PowerShell It is quite simple to create a remediation task via PowerShell. The main thing to remember is that you must be using a _deployIfNotExists_ policy. ```powershell PS51> Start-AzPolicyRemediation -Name 'remediationTask' -PolicyAssignmentId '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/{assignmentID}' ``` ### Azure CLI In lieu of using PowerShell you can also use the Azure CLI to start a remediation task as well. The same goes for this as the PowerShell task. ```bash > az policy remediation create --name remediationTask --policy-assignment '/subscriptions/{subscriptionId}/providers/Microsoft.Authorization/policyAssignments/{assignmentID}' ``` ## Summary The power in using Azure Policies is that for any Azure subscription you can define any number of flexible policies to help you manage your environment. Furthermore, with time, effort and thought put into how you structure your policies, initiatives and parameters you can create a well-defined and easy to remediate setup. Considering that Azure Policies are free for any Azure Subscription, it makes a lot of sense to take the time to implement what you need. Considering the flexibility in how to create and deploy these definitions and policies, it can apply to nearly anything and help you keep a handle on your environment! Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-policy%2F&text=Regain%20Control%20of%20Azure%20Resources%20with%20Azure%20Policy)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fazure-policy%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fazure-policy%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/2026/07/featured_image-1.webp) ### [Microsoft Azure Certification Roadmap: Choose the Right Path](/azure-certification-roadmap-2/) Choose the right Microsoft Azure certification for your career goals. Compare AZ-900, AZ-104, AZ-305, AZ-400, AZ-700, DP-700, study timelines, and 2026 retirements. ![](https://adamtheautomator.com/wp-content/uploads/2021/05/How-to-RenameMove-Azure-Resource-Groups-GUI-and-CLI.jpg) ### [Smart Ways to Rename Azure Resource Groups (GUI and CLI)](/rename-azure-resource-group/) Unlock the secret to Rename Azure Resource Groups! Dive into our easy guide for reshaping your Azure landscape with Portal, PowerShell, and CLI techniques. ![](https://adamtheautomator.com/wp-content/uploads/2021/03/azure-cli.jpg) ### [Master Azure CLI: Command Your Cloud with Confidence](/azure-cli/) Unlock the full potential of cloud management with the Azure CLI. This guide provides the essentials to get you started with Azure resources efficiently. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)