Managing Governance via Azure Policy

This lab teaches you how to implement organizational governance using Azure Policy and resource tagging. You'll learn to enforce resource tagging, update existing resources, and use resource locks.

Scenario

Improve Azure resource management by:

Applying resource tags for metadata.
Enforcing resource tags for new resources.
Updating existing resources with tags.
Using resource locks for protection.

Interactive Simulations

Optional simulations:

Manage governance via Azure policy.

Architecture Diagram

Diagram of the task architecture.

Task 1: Assign Tags

Sign in to the Azure portal: https://portal.azure.com
Create a resource group (e.g., az104-rg2 in East US).
On the Tags tab, create a tag (e.g., Cost Center: 000).

Screenshot of the policy definition.

Task 2: Enforce Tagging

Navigate to: Policy > Authoring > Definitions > find “Require a tag and its value on resources”
Click "Assign" and select your subscription and resource group.
Configure the assignment:

Assignment name Require Cost Center tag with Default value

DescriptionRequire Cost Center tag with default value for all resources in the resource group

Policy enforcement Enabled

Set parameters (e.g., Tag Name: Cost Center, Tag Value: 000).
Create the assignment.
Try creating a storage account without the tag to verify enforcement. you will get this error message:

Task 3: Apply Tagging

Navigate to: Policy > Authoring > Assignments
Delete the previous assignment.
Assign the "Inherit a tag from the resource group if missing" policy.
Configure the assignment:

Assignment name Inherit the Cost Center tag and its value 000 from the resource group if missing

Description Inherit the Cost Center tag and its value 000 from the resource group if missing | | Policy enforcement Enabled
Set parameters (e.g., Tag Name: Cost Center).
Enable remediation task.

Policy to remediate : Inherit a tag from the resource group if missing
Create the assignment.
Create a storage account without the tag to verify automatic tagging.

Screenshot of the policy remediation page.

Task 4: Configure Resource Locks

Navigate to your resource group > Settings > Locks > Add
Create a lock (e.g., rg-lock with delete lock type).
Try deleting the resource group to verify the lock.

Cleanup

Delete the lab resources to avoid unnecessary costs.

Azure portal: Delete the resource group.
PowerShell: Remove-AzResourceGroup -Name resourceGroupName
CLI: az group delete --name resourceGroupName

Key Takeaways

Azure tags are key-value pairs used as metadata for resources.
Azure Policy enforces conventions and compliance for resources.
Remediation tasks bring non-compliant resources into compliance.
Resource locks prevent accidental deletion or modification.
Azure Policy is a pre-deployment security practice, while RBAC and resource locks are post-deployment.

Managing Governance via Azure Policy

Comments

AZ-104

Lab 03: Managing Azure Resources with ARM and Bicep Templates

More from this blog

AZ-140 Lab tips II:

AZ-700 Lab 03

AZ - 700 Lab 2

AZ - 700 - 03 - Design and implement Azure ExpressRoute

AZ - 700 Lab 1

Scenario

Interactive Simulations

Architecture Diagram

Task 1: Assign Tags

Task 2: Enforce Tagging

Task 3: Apply Tagging

Task 4: Configure Resource Locks

Cleanup

Key Takeaways

Command Palette

Comments

AZ-104

Lab 03: Managing Azure Resources with ARM and Bicep Templates

More from this blog

Scenario

Interactive Simulations

Architecture Diagram

Task 1: Assign Tags

Task 2: Enforce Tagging

Task 3: Apply Tagging

Task 4: Configure Resource Locks

Cleanup

Key Takeaways