Making Azure Policy do the remembering

The problem with good intentions

Security guidance that lives in a wiki depends on someone remembering it at the exact moment a resource is created. Azure Policy moves that memory into the platform.

What I built

I worked through a small subscription with policies for:

• Requiring tags that identify owner and environment
• Denying public blob access on storage accounts
• Auditing resources that allow older TLS versions
• Restricting deployments to an approved set of regions

I started in Audit mode, watched what would have been blocked, and only then moved selected policies to Deny.

The lesson

A policy is a product decision, not just a JSON definition. Too loose and it is decoration; too strict and people route around it. The best guardrails are the ones that make the safe path the easy path.

Next

I want to explore policy-as-code in CI, so infrastructure changes are evaluated before they ever reach the subscription.