Enforce Cloud Security with Azure Policy

Introduction

30 Second Summary

Every organization running workloads in the cloud needs guardrails that prevent security misconfigurations before they cause incidents. Think of it like automatic locks on doors that refuse to open unless the right credentials are presented.

In this project, you will build a cloud security compliance framework using Azure Policy and Microsoft Defender for Cloud. You'll define security guardrails, map controls to a regulatory compliance framework, and prevent misconfigurations at the infrastructure layer.

What You'll Build

You'll create a governed Azure environment where security policies actively block insecure deployments, a compliance dashboard maps your posture against NIST SP 800-53, and a custom policy enforces your organization's specific security requirements.

By the end of this project, you'll have:

• A resource group governed by built-in security policies and a regulatory compliance initiative (NIST SP 800-53 Rev. 5) evaluated against your environment.
• A custom Azure Policy using the Deny effect that blocks insecure storage account deployments in real time.
• A compliance dashboard and Secure Score assessment showing your security posture across controls.
• Secret Mission: Write a DeployIfNotExists policy that auto-remediates non-compliant resources by enabling diagnostic logging on storage accounts.

Are there any prerequisites?

You'll need an Azure account. A free Azure account works perfectly for this project since Azure Policy is offered at no additional cost to all Azure subscribers, and the Foundational CSPM tier in Defender for Cloud is also free.

Before We Start

Before We Start...

Set Up Your Azure Environment

Every security compliance project needs a controlled environment. Before you can assign policies or evaluate regulatory frameworks, you need a dedicated space in Azure where your governance work stays isolated from other resources.

In this step, you'll sign into the Azure Portal, create a resource group to contain your project, and confirm you have access to Azure Policy.

In this step, get ready to:

• Sign into the Azure Portal and confirm your subscription.
• Create a dedicated resource group for this project.
• Verify access to the Azure Policy service.

Sign in to the Azure Portal

• Open your browser and navigate to portal.azure.com.
• Sign in with your Azure account credentials.
• Once signed in, type Subscriptions in the portal search bar at the top of the page.
• Select Subscriptions from the search results.
• Confirm you see at least one subscription with a status of Active. This is the subscription your policies will be scoped to.

Don't have an Azure account yet?

You can create a free Azure account at azure.microsoft.com/free. New customers get $200 credit for 30 days plus free monthly amounts of 20+ popular services for 12 months.

Azure Policy and Foundational CSPM in Defender for Cloud are both free for all Azure subscribers, so this project will not cost you anything.

Don't see any subscriptions?

Make sure you're in the correct directory. Click your account icon in the top-right corner of the portal and choose Switch directory. Try each available directory and check Subscriptions again.

If you still see nothing, your account may not have the required permissions. Help me find my Azure subscription.

Create a resource group for this project

A resource group is a container that holds related Azure resources together. You'll create one specifically for this project so all your policy work stays isolated and easy to clean up later.

• In the search box at the top of the portal, type Resource groups.
• Select Resource groups from the search results.
• Click + Create.
• In the Subscription dropdown, select your active subscription.
• In the Resource group field, enter nextwork-policy-rg.
• In the Region dropdown, select a region close to you (for example, East US or West Europe).
• Click Review + create.
• Click Create.

After a few seconds, you should see a notification confirming your resource group was created. You can click Go to resource group from the notification, or find it by searching for Resource groups again.

Why create a separate resource group?

Scoping your policies to a dedicated resource group keeps your learning environment isolated from any other Azure resources you might have. It also makes cleanup simple. When you're done with this project, you can delete the entire resource group in one action.

Seeing a permissions error?

You need at least Contributor-level access on your subscription to create resource groups. If you're using an organizational account, ask your administrator to grant you Contributor access on the subscription.

Help me resolve my permissions issue.

Verify access to Azure Policy

Azure Policy is the governance engine you'll use throughout this project to enforce security rules. Let's confirm you can access it.

• In the portal search bar at the top, type Policy.
• Select Policy from the search results.
• Confirm the Azure Policy overview page loads. You should see sections for Assignments, Compliance, and Definitions in the left navigation.

What is Azure Policy?

Azure Policy is a free service that evaluates your Azure resources against business rules you define. It can audit resources that violate rules, block non-compliant deployments entirely, or even auto-remediate misconfigured resources.

Think of it as the security guardrail layer that prevents misconfigurations before they become incidents.

Your Azure environment is ready. Next up, you'll assign your first built-in security policies and start seeing how Azure evaluates compliance in real time.

Assign Built-in Security Policies

Your resource group is ready and waiting. Now it's time to put security guardrails around it.

Azure Policy ships with hundreds of built-in policy definitions covering common security controls. Instead of writing rules from scratch, you can assign these definitions to a scope (like your resource group) and Azure continuously evaluates resources against them. In this step, you'll assign two built-in security policies and observe how the compliance dashboard reports their status.

In this step, get ready to:

• Assign a policy that audits VMs without managed disks.
• Assign a policy that audits storage accounts without HTTPS.
• Review the compliance dashboard to see initial evaluation results.

Assign the "Audit VMs that do not use managed disks" policy

A policy assignment is the act of binding a policy definition to a specific scope. The scope determines which resources Azure evaluates against that definition.

• Return to the Azure Policy blade in the Azure Portal.
• Select Assignments in the left menu.
• Select Assign Policy at the top of the Assignments pane.

What is the Assign Policy page?

This page is a multi-tab wizard where you configure the scope, select a policy definition, set enforcement options, and optionally add a non-compliance message. You'll work through the Basics tab first.

• On the Basics tab, click the ellipsis (...) next to Scope.
• Select your subscription, then select the nextwork-policy-rg resource group.
• Click Select to apply the scope.
• Click the ellipsis (...) next to Policy definition to open the list of available definitions.
• In the search box, type Audit VMs that do not use managed disks.
• Select the policy from the results, then click Add.
• Leave the Assignment name as the default (it auto-populates with the policy name).
• Confirm Policy enforcement is set to Enabled.
• Click Next to advance through the Parameters and Remediation tabs without making changes.
• On the Non-compliance messages tab, enter Virtual machines should use managed disks as the message.
• Click Review + create, then click Create.

What does this policy do?

This policy uses the Audit effect. It flags any virtual machine in the resource group that uses unmanaged disks as non-compliant. It does not block anything. It only reports.

Think of it as a security camera, not a locked door. You'll build the locked door (a Deny policy) in a later step.

Don't see the policy in search results?

Make sure the Type filter is set to Built-in in the Available Definitions pane. If you still can't find it, clear any category filters and search again.

Help me find the built-in policy definition in Azure Policy

Assign the "Storage accounts should allow access only from HTTPS" policy

Your second policy establishes a baseline security check for storage accounts. This ensures any storage account in your resource group that allows non-HTTPS traffic gets flagged.

• Return to Policy > Assignments.
• Select Assign Policy again.
• Set the Scope to your subscription and nextwork-policy-rg resource group (same as before).
• Click the ellipsis next to Policy definition.
• Search for Storage accounts should allow access only from HTTPS.
• Select the policy and click Add.
• Leave the Assignment name as the default.
• Confirm Policy enforcement is Enabled.
• Click Next through the Parameters and Remediation tabs without changes.
• On the Non-compliance messages tab, enter Storage accounts must use HTTPS traffic only.
• Click Review + create, then Create.

What is the Audit effect?

The Audit effect evaluates resources and marks non-compliant ones in the compliance dashboard. It does not prevent resource creation or modification.

Other effects include Deny (blocks non-compliant deployments) and DeployIfNotExists (auto-remediates by deploying a missing resource). You'll use Deny in Step 4.

Review the compliance dashboard

Now that both policies are assigned, Azure begins evaluating your resource group against them. The compliance dashboard shows you which resources pass and which ones fail.

• In the Policy blade, select Compliance from the left menu.
• Look for your two policy assignments in the list.
• Observe the compliance state column. It may show Not started or begin populating within a few minutes.

Why does compliance take a few minutes?

Azure Policy evaluates resources asynchronously. A new policy assignment takes a few minutes to become active and provide results about the policy's state. Your resource group is currently empty, so both policies will likely show as compliant once evaluation completes.

As you add resources in later steps, the dashboard updates to reflect their compliance. This is how security teams monitor drift in real time.

Still seeing "Not started" after several minutes?

Policy evaluation can take up to 30 minutes on a busy subscription. If your dashboard still shows no data after 5 minutes, try refreshing the page. The compliance scan runs on Azure's schedule, not on demand.

Help me understand why my compliance dashboard isn't showing results yet

You now have two security guardrails watching over your resource group. Next up, you'll assign an entire regulatory compliance framework with hundreds of controls in a single action.

Apply a Regulatory Compliance Initiative

In the previous step, you assigned individual policies that check for specific security issues. That's useful for targeted controls, but real-world compliance requires mapping your environment against an entire regulatory framework with hundreds of controls.

In this step, you'll assign a full NIST SP 800-53 Rev. 5 regulatory compliance initiative to your subscription. This is a built-in collection of 200+ policy definitions organized by compliance domains and security controls. You'll see how Azure maps your resource posture to individual controls, domains, and responsibility assignments.

In this step, get ready to:

• Assign the NIST SP 800-53 Rev. 5 initiative in audit-only mode.
• Explore the compliance dashboard Controls tab.
• Investigate a non-compliant control to see contributing policies and flagged resources.

Assign the NIST SP 800-53 Rev. 5 initiative

A policy initiative (also called a policy set) bundles many individual policy definitions into a single assignment. Regulatory compliance initiatives go further by organizing those policies into named controls and compliance domains, giving you a structured view of your security posture.

• In the Azure Portal search bar, type Policy and select it from the results.
• In the left menu under Authoring, select Definitions.
• In the Category filter dropdown, select Regulatory Compliance.
• Locate NIST SP 800-53 Rev. 5 in the list and select it to open its definition page.
• Select Assign at the top of the page to open the Assign Initiative page.

Why assign at subscription scope?

Regulatory frameworks like NIST SP 800-53 evaluate controls across all resource types in your environment. Assigning at the subscription scope ensures the initiative evaluates everything beneath it, including your nextwork-policy-rg resource group and any other resources in the subscription.

• On the Basics tab, click the Scope ellipsis (...) and select your subscription. Do not select a resource group. Click Select.
• Leave the Assignment name as the default (it auto-populates with the initiative name).
• Change Policy enforcement to Disabled. This sets the enforcement mode to DoNotEnforce, which means Azure evaluates compliance without blocking any deployments.
• Click Review + create at the bottom of the page.
• Review the assignment details, then click Create.

What is enforcement mode DoNotEnforce?

When enforcement mode is set to Disabled (DoNotEnforce), Azure still evaluates all resources against the initiative's policies and reports compliance state. It just won't block or modify any deployments. This is the standard approach in production environments when you first assign a large compliance framework, because you want to observe your posture before enforcing changes.

Evaluation takes time

The NIST SP 800-53 Rev. 5 initiative contains over 200 policy definitions. Initial evaluation against your subscription can take up to 30 minutes. You can continue exploring while it populates.

Explore the compliance dashboard controls

Once the evaluation begins populating, the compliance dashboard transforms into a structured view of your regulatory posture organized by NIST control families.

• In the left menu of the Azure Policy blade, select Compliance.
• Locate the NIST SP 800-53 Rev. 5 initiative in the compliance list and select it.
• Select the Controls tab at the top of the compliance details page.

You should see a table of controls, each showing its compliance state, compliance domain, and responsibility assignment.

What does the Controls tab show?

Each row in the Controls tab represents a NIST security control (like AC-2 Account Management or AU-6 Audit Record Review). The columns show:

• Compliance state (Compliant, Non-compliant, or Not started).
• Compliance domain (the control family it belongs to, such as Access Control or Audit and Accountability).
• Responsibility (Customer, Microsoft, or Shared). This tells you who is responsible for implementing the control.
• Counts of non-compliant and compliant policy definitions that make up that control.

• Use the Compliance domain filter to browse different control families (for example, Access Control or System and Communications Protection).
• Notice which controls show as Non-compliant. These are the controls where your environment doesn't yet meet all the policy requirements.

Still seeing Not started everywhere?

The compliance evaluation takes a few minutes to become active after assignment. If all controls show Not started, wait 5-10 minutes and refresh the page. Large initiatives like NIST may take up to 30 minutes to fully evaluate.

help me understand why my NIST initiative compliance isn't showing results yet

Investigate a non-compliant control

Each non-compliant control tells a story about where your environment falls short of a specific security requirement. Drilling into a control reveals exactly which policies contribute to it and which resources are flagged.

• On the Controls tab, find a control that shows Non-compliant in the compliance state column. Select it to open its detail page.
• Review the Overview section, which shows the control's description and requirements.
• Select the Policies tab to see all the individual policy definitions in the initiative that contribute to this control.
• Select the Resource compliance tab to see which specific resources in your environment are flagged as non-compliant for this control.

Why does one control have multiple policies?

A single NIST control like SC-8 (Transmission Confidentiality and Integrity) may require multiple technical implementations. For example, it might need HTTPS on storage accounts, TLS on databases, and encryption in transit on web apps. Each technical check is a separate policy definition, and all of them contribute to that one control's compliance state.

If even one contributing policy is non-compliant, the entire control shows as non-compliant.

You now have a regulatory compliance framework actively evaluating your Azure environment. Next up, you'll write your own custom policy that actively blocks insecure deployments before they happen.

Create a Custom Deny Policy

So far, you've been using Azure's built-in policies to audit your environment. Auditing flags non-compliant resources, but it doesn't stop anyone from creating insecure ones.

In this step, you'll write your own custom policy that actively blocks insecure configurations at deployment time. This is the difference between knowing about a problem and preventing it from ever happening.

In this step, get ready to:

• Write a custom policy definition that denies storage accounts without HTTPS enforcement.
• Assign the custom policy to your resource group with active enforcement.
• Test the policy by attempting to create a non-compliant storage account.

Write the custom policy definition

Built-in policies cover common scenarios, but organizations often need rules tailored to their own security standards. Custom policy definitions let you encode any requirement into an enforceable rule.

• In the Azure Portal search bar, type Policy and select it from the results.
• In the left menu under Authoring, select Definitions.
• Click + Policy definition at the top of the page.

The policy definition form opens with several fields to fill in.

• For Definition location, click the ellipsis (...) and select your subscription.
• For Name, enter deny-http-storage-policy.
• For Description, enter Denies storage accounts that do not enforce HTTPS-only traffic.
• For Category, select Use existing and choose Storage. If Storage is not available, create a new category called Security.

• In the Policy rule editor, delete any existing content and paste the following JSON:

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Storage/storageAccounts"
        },
        {
          "field": "Microsoft.Storage/storageAccounts/supportsHttpsTrafficOnly",
          "notEquals": "true"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {}
}

What does this policy rule do?

• mode: "All" tells Azure Policy to evaluate all resource types, including those without tags and location.
• The if block uses allOf to check two conditions: the resource is a storage account, AND its supportsHttpsTrafficOnly property is not set to true.
• The then block applies the deny effect, which blocks the deployment entirely instead of just flagging it.

• Click Save to create your custom policy definition.

You should land on your new policy definition's overview page.

Seeing a validation error?

Make sure the JSON is valid with no trailing commas or missing brackets. The portal editor highlights syntax errors in red.

Also confirm your Definition location is set to a subscription, not a management group you don't have access to.

Why can't I save my custom policy definition?

Assign the custom policy to your resource group

A policy definition on its own is just a blueprint. To enforce it, you need to assign it to a specific scope.

• On your new policy definition's overview page, click Assign policy.
• On the Basics tab, click the ellipsis (...) next to Scope.
• Select your subscription, then select nextwork-policy-rg as the resource group.
• Click Select to confirm the scope.
• Confirm that Policy enforcement is set to Enabled. This is the Default enforcement mode that actively triggers the deny effect.

What is enforcement mode Default?

Enforcement mode Default triggers the policy effect (in this case, deny). This means non-compliant deployments are actively blocked.

Compare this to DoNotEnforce mode, which you used for the NIST initiative. That mode observes compliance without blocking anything.

• Click the Non-compliance messages tab at the top of the page.
• In the message field, enter: HTTPS-only traffic is required for all storage accounts. Enable Secure transfer required to comply with organizational security policy.
• Click Review + create, then click Create.

Your custom deny policy is now actively enforcing HTTPS requirements on storage accounts in your resource group.

Why set a non-compliance message?

When a deployment is denied, the non-compliance message appears in the error details. This tells the person attempting the deployment exactly why it was blocked and what they need to change.

In production, clear messages reduce support tickets and help teams self-remediate without involving the security team.

Don't see the Non-compliance messages tab?

Make sure you're on the Assign policy page (not the definition page). The tab appears at the top alongside Basics, Parameters, and Remediation.

Help me find the non-compliance messages tab in Azure Policy assignment

Test the policy enforcement

The real proof of a deny policy is seeing it block a non-compliant deployment. You'll now attempt to create a storage account that violates your policy, then create one that complies.

• In the Azure Portal search bar, type Storage accounts and select it.
• Click + Create.
• On the Basics tab, select nextwork-policy-rg as the resource group.
• Enter a globally unique storage account name (for example, nwpolicytesthttp followed by a few random digits).
• Leave all other settings as defaults.
• Click the Advanced tab.
• Under Security, uncheck Require secure transfer for REST API operations. This disables HTTPS enforcement, which should trigger your deny policy.
• Click Review + create, then click Create.

The deployment should fail with a policy violation error. You should see your non-compliance message in the error details.

What should I see?

Azure displays a deployment error with a message indicating the resource was disallowed by policy. Your custom non-compliance message appears in the error details, explaining that HTTPS-only traffic is required.

This is the deny effect in action. The deployment never starts because the policy blocks it at the Azure Resource Manager layer.

Storage account created successfully instead of being denied?

Policy assignments can take a few minutes to become active. Wait 5 minutes and try creating the storage account again.

Also confirm that your policy assignment scope is set to nextwork-policy-rg and that enforcement mode is Enabled (not DoNotEnforce).

Why isn't my custom deny policy blocking the storage account creation?

Now confirm that a compliant storage account deploys successfully.

• Click + Create again on the Storage accounts page.
• Select nextwork-policy-rg as the resource group.
• Enter a different globally unique name (for example, nwpolicytesthttps followed by a few random digits).
• On the Advanced tab, make sure Require secure transfer for REST API operations is checked (this is the default).
• Click Review + create, then click Create.

This deployment should succeed because the storage account complies with your policy's HTTPS requirement.

You've just proved that your custom policy actively prevents insecure configurations. Next up, you'll review your overall security posture in Microsoft Defender for Cloud.

Review Your Security Posture in Defender for Cloud

In the previous step, you created a custom deny policy that actively blocks insecure storage account configurations before they can be deployed. That's the prevention side of cloud security governance in action.

Prevention alone is not enough. You also need visibility into your overall security posture and guidance on how to fix existing issues. Microsoft Defender for Cloud provides this detection layer, aggregating security recommendations into a single dashboard with a Secure Score that quantifies your environment's health.

In this step, get ready to:

• Review your Secure Score in Microsoft Defender for Cloud.
• Explore the Regulatory Compliance dashboard and compare it to the Azure Policy compliance view.
• Understand how Prevention, Detection, and Remediation form the complete GRC lifecycle.

Open Microsoft Defender for Cloud and review your Secure Score

Your Secure Score is a single percentage that summarizes how well your environment follows security best practices. Each recommendation that Defender for Cloud identifies contributes to this score.

• In the Azure Portal search bar at the top, type Microsoft Defender for Cloud and select it from the results.
• On the Defender for Cloud overview page, locate the Secure Score tile. This shows your overall security posture as a percentage.
• Click the Secure Score tile to open the dedicated Secure Score page.
• Review the score broken down by subscription. Select your subscription to see the list of prioritized recommendations and the potential effect that remediating them would have on your score.

What is Secure Score?

Secure Score aggregates all of Defender for Cloud's security recommendations into a single metric. Each security control (a group of related recommendations) contributes points. The more recommendations you resolve, the higher your score climbs.

In a real organization, security teams track this score over time to measure whether their security posture is improving or declining.

Why is my score low?

A low Secure Score is completely normal for a new environment. It means Defender for Cloud has identified recommendations you have not acted on yet. This is exactly how the detection layer works. It finds issues so you can prioritize and fix them.

Explore the Regulatory Compliance dashboard in Defender for Cloud

In Step 3, you explored compliance through Azure Policy > Compliance. Defender for Cloud offers its own Regulatory Compliance view that adds remediation guidance alongside the same compliance data.

• In the Defender for Cloud left menu, click Regulatory compliance.
• Observe the compliance standards listed. You should see at least the Microsoft cloud security benchmark (enabled by default with the free Foundational CSPM).
• If your NIST SP 800-53 Rev. 5 initiative appears here, select it to see the same controls and compliance states you explored in the Azure Policy compliance dashboard.

Azure Policy compliance vs Defender for Cloud compliance

Both dashboards show compliance data from the same underlying Azure Policy evaluations. The difference is context. Azure Policy's compliance dashboard focuses on policy pass/fail status. Defender for Cloud's Regulatory Compliance dashboard adds remediation guidance, linking each failing control to actionable recommendations.

The full Regulatory Compliance dashboard in Defender for Cloud (with non-default standards like NIST) requires a paid Defender plan. The free Foundational CSPM tier shows compliance against the Microsoft cloud security benchmark. For additional standards, the Azure Policy compliance view (which you used in Step 3) provides the same compliance data at no cost.

• Select and expand any compliance control to see the assessments associated with it.
• Click Control details to view the Overview, Your Actions, and Microsoft Actions tabs.
• Notice how Your Actions shows automated assessments with the number of failed resources and links to remediation information.

Review a recommendation and understand the GRC lifecycle

The final piece of the puzzle is remediation. Defender for Cloud does not just detect issues. It tells you how to fix them.

• In the Defender for Cloud left menu, click Recommendations.
• Select any recommendation from the list (look for one with a High or Medium severity).
• Click Take action and review the Remediate section. This section provides step-by-step instructions for fixing the security issue.

What is the GRC lifecycle?

You have now seen all three stages of a complete GRC (Governance, Risk & Compliance) lifecycle:

• Prevention via Azure Policy. Your deny policy blocks insecure configurations before they are deployed.
• Detection via Microsoft Defender for Cloud. The Secure Score and recommendations identify existing security gaps.
• Remediation via Defender for Cloud's guidance. Each recommendation includes concrete steps to fix the issue.

In production, security teams cycle through these three stages continuously. Azure Policy prevents new issues, Defender for Cloud detects what slipped through, and remediation closes the loop.

Don't see any recommendations yet?

Defender for Cloud assessments can take up to 24 hours to populate fully after first enabling the service. If you see few or no recommendations, wait a few minutes and refresh the page.

help me understand why my Defender for Cloud recommendations are not showing up

Secret mission

Auto-Remediate with DeployIfNotExists

Your deny policy blocks bad deployments. But what about resources that already exist in a non-compliant state? In this secret mission, you'll write a DeployIfNotExists policy that automatically deploys diagnostic settings on storage accounts, complete with a managed identity and remediation tasks.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. Azure Policy and Foundational CSPM are free, so no ongoing charges accrue from the policies themselves. The only cost is from storage accounts in your resource group (pennies per month for empty accounts).

Resources you used:

• Resource group nextwork-policy-rg (contains storage accounts and Log Analytics workspace).
• Policy assignments scoped to nextwork-policy-rg (4 assignments).
• NIST SP 800-53 Rev. 5 initiative assignment at subscription scope.
• Custom policy definitions at subscription level (deny-http-storage-policy, deploy-diagnostics-storage-policy).
• Microsoft Defender for Cloud Foundational CSPM (free, enabled by default).

Keep everything running

No action needed. Choose this if you plan to continue exploring Azure Policy or want to reference your compliance dashboard later.

• All policy assignments and definitions remain active at no cost.
• Storage accounts in nextwork-policy-rg cost pennies per month while empty.
• Defender for Cloud Foundational CSPM is always free.

Pause - I'll come back to this later

There are no compute resources running in this project, so there is nothing to pause. Your policies evaluate passively and cost nothing.

• If you want to stop the storage account charges, delete the storage accounts inside nextwork-policy-rg but keep the resource group and policy assignments for reference.
• Everything else (policies, Defender for Cloud) is free and can stay.

Delete - I don't want to use this again

Remove all project resources and start fresh. Follow these steps in order.

• Delete the NIST SP 800-53 Rev. 5 initiative assignment (subscription scope): search for Policy in the portal search bar and open it.
• Select Assignments under Authoring in the left side of the Azure Policy page.
• Locate the NIST SP 800-53 Rev. 5 initiative assignment.
• Select the ellipses at the end of the row and select Delete assignment.
• Delete the resource group: search for Resource groups in the portal search bar.
• Select nextwork-policy-rg.
• Click Delete resource group at the top.
• Type nextwork-policy-rg to confirm, then click Delete.
• Delete the custom policy definitions: return to Policy in the portal.
• Select Definitions under Authoring in the left menu.
• Search for your deny-http-storage-policy definition, select the ellipses, and choose Delete definition.
• Repeat for your deploy-diagnostics-storage-policy definition.

Why delete assignments before definitions?

Azure prevents you from deleting a policy definition while an active assignment still references it. Deleting the resource group removes the resource-group-scoped assignments, but the NIST initiative is assigned at subscription scope and must be deleted separately first.

Nice Work!

Nice Work!

You just built a cloud security compliance framework from scratch. Your Azure environment is now governed by policies that actively prevent misconfigurations, audited against a real-world regulatory framework, and monitored through a centralized security posture dashboard.

You've learned how to:

• Assign built-in Azure Policies and a regulatory compliance initiative (NIST SP 800-53 Rev. 5) to enforce security baselines and audit compliance across your cloud environment.
• Create a custom Deny policy that prevents insecure storage account deployments, and test enforcement by triggering a real policy denial.
• Review your Secure Score in Microsoft Defender for Cloud and understand the complete GRC lifecycle: Prevention, Detection, and Remediation.
• Auto-remediate non-compliant resources using a DeployIfNotExists policy with a managed identity (Secret Mission).

Ready to quiz yourself?