Azure Policy Security

Azure Policy & Security Governance

Shared Workflow Routing

• Use the shared workflow spec for deterministic multi-plugin routing: workflows/multi-plugin-workflows.md.
• Apply the trigger phrases, handoff contracts, auth prerequisites, validation checkpoints, and stop conditions before escalating to the next plugin.

This skill provides comprehensive knowledge for assessing Azure governance posture via the Azure Policy REST API — policy assignments, compliance state queries, initiatives, exemptions, and drift analysis with actionable remediation plans.

Integration Context Contract

• Canonical contract: docs/integration-context.md

* Use sovereign cloud values from the canonical contract when applicable.

Fail fast before API calls when required context is missing or invalid. Redact tenant/subscription/object IDs in outputs.

Base URL

https://management.azure.com/{scope}/providers/Microsoft.Authorization
https://management.azure.com/{scope}/providers/Microsoft.PolicyInsights

API Endpoints

Policy Assignments

Policy Definitions

Policy Set Definitions (Initiatives)

Policy States (Compliance Data)

Policy Exemptions

Policy Assignment Request Body

PUT /{scope}/providers/Microsoft.Authorization/policyAssignments/{name}?api-version=2023-04-01
{
  "properties": {
    "displayName": "Require tags on resource groups",
    "description": "Enforce CostCenter and Environment tags on all resource groups",
    "policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/{guid}",
    "enforcementMode": "Default",
    "notScopes": [
      "/subscriptions/{id}/resourceGroups/rg-sandbox"
    ],
    "parameters": {
      "tagName": {
        "value": "CostCenter"
      }
    },
    "nonComplianceMessages": [
      {
        "message": "This resource group must have a CostCenter tag."
      }
    ],
    "metadata": {
      "assignedBy": "Cloud Center of Excellence"
    }
  },
  "identity": {
    "type": "SystemAssigned"
  },
  "location": "eastus"
}

Key Assignment Properties

Policy State Query

Query Non-Compliant Resources

POST /subscriptions/{id}/providers/Microsoft.PolicyInsights/policyStates/latest/queryResults
  ?api-version=2019-10-01
  &$filter=ComplianceState eq 'NonCompliant'
  &$top=100
  &$orderby=timestamp desc

Summarize Compliance (Aggregation)

POST /subscriptions/{id}/providers/Microsoft.PolicyInsights/policyStates/latest/queryResults
  ?api-version=2019-10-01
  &$apply=groupby((ComplianceState), aggregate($count as Count))

Query by Policy Definition

POST /subscriptions/{id}/providers/Microsoft.PolicyInsights/policyStates/latest/queryResults
  ?api-version=2019-10-01
  &$filter=ComplianceState eq 'NonCompliant' and PolicyDefinitionId eq '/providers/microsoft.authorization/policydefinitions/{guid}'
  &$top=50

OData Query Parameters

Filterable Fields

Policy Exemption Request Body

PUT /{scope}/providers/Microsoft.Authorization/policyExemptions/{name}?api-version=2022-07-01-preview
{
  "properties": {
    "policyAssignmentId": "/subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments/{name}",
    "exemptionCategory": "Waiver",
    "displayName": "Exempt sandbox cluster from SKU limit",
    "description": "Temporary exemption for dev/test cluster — approved by IA",
    "expiresOn": "2026-06-30T23:59:00Z",
    "policyDefinitionReferenceIds": [
      "Limit_Skus"
    ],
    "metadata": {
      "requestedBy": "Platform team",
      "approvedBy": "Information Assurance",
      "ticketRef": "CHG-2026-0042"
    }
  }
}

Exemption Properties

Compliance State Reference

Compliance percentage formula:

(Compliant + Exempt + Unknown + Protected) / Total resources * 100

Enforcement Mode Reference

DoNotEnforce is different from the Disabled effect — Disabled prevents evaluation entirely; DoNotEnforce evaluates but does not act. Use DoNotEnforce for "what-if" testing.

Policy Effect Reference

Built-in Initiative Reference

Full ARM ID format: /providers/Microsoft.Authorization/policySetDefinitions/{guid}

Required Permissions

Error Handling

Error Response Format

{
  "error": {
    "code": "PolicyAssignmentNotFound",
    "message": "The policy assignment 'XYZ' could not be found.",
    "target": "policyAssignmentName"
  }
}

OData Filter Reference

# All non-compliant resources
$filter=ComplianceState eq 'NonCompliant'

# Non-compliant for a specific policy
$filter=ComplianceState eq 'NonCompliant' and PolicyDefinitionId eq '/providers/...'

# Non-compliant by resource type
$filter=ComplianceState eq 'NonCompliant' and ResourceType eq 'Microsoft.Compute/virtualMachines'

# Audit or deny actions only
$filter=PolicyDefinitionAction eq 'audit' or PolicyDefinitionAction eq 'deny'

# Aggregate by compliance state
$apply=groupby((ComplianceState), aggregate($count as Count))

# Count non-compliant per policy
$apply=groupby((PolicyAssignmentId, PolicyDefinitionId), aggregate($count as NumNonCompliant))

Common Posture Patterns

Pattern 1: Baseline Coverage Assessment

1. GET /providers/Microsoft.Authorization/policySetDefinitions/{cis-guid} — get CIS initiative details
2. GET /subscriptions/{id}/providers/Microsoft.Authorization/policyAssignments — list assignments
3. Verify the baseline initiative is assigned at the target scope
4. POST .../policyStates/latest/summarize — get compliance summary
5. Calculate coverage: Compliant / (Compliant + NonCompliant) * 100
6. Flag control areas below 90% coverage for remediation

Pattern 2: Compliance Drift Detection

1. POST .../policyStates/latest/queryResults with $from = last scan date — get new non-compliant resources
2. Compare current non-compliance count vs baseline snapshot
3. Identify resources that were compliant but are now non-compliant
4. Check for new exemptions that may mask drift
5. Produce drift report with severity classification and change attribution

Pattern 3: Exemption Lifecycle Review

1. GET /subscriptions/{id}/providers/Microsoft.Authorization/policyExemptions — list all exemptions
2. Flag exemptions past expiresOn date — expired but still present
3. Flag exemptions without expiresOn — permanent waivers requiring justification review
4. Verify each exemption has metadata: requestedBy, approvedBy, ticketRef
5. Produce aging report with time-since-creation and days-until-expiry

Pattern 4: Remediation Wave Planning

1. POST .../policyStates/latest/queryResults — get all non-compliant resources
2. Group by PolicyDefinitionAction — separate deny (blocking) from audit (informational)
3. Prioritize: blocking violations first, then high-severity audits
4. Group by resource group and owner for batch remediation
5. Create remediation waves: Quick Wins (tag fixes, config changes) → Structural (architecture changes)
6. Assign owners and due dates per wave

Decision Tree

1. Need to establish scope, baseline, severity model, or ownership? → setup
2. Need baseline adherence/guardrail completeness metrics? → policy-coverage
3. Need changes/regressions over time, including exemption aging? → drift-analysis
4. Need execution roadmap from existing coverage/drift findings? → remediation-plan
5. Full posture-to-execution workflow? Run: setup → policy-coverage / drift-analysis → remediation-plan

Minimal References

• azure-policy-security/commands/setup.md
• azure-policy-security/commands/policy-coverage.md
• azure-policy-security/commands/drift-analysis.md
• azure-policy-security/commands/remediation-plan.md
• azure-policy-security/README.md

Progressive Disclosure — Reference Files