What is Azure Policy and how do you enforce governance at scale

Crisp answer: Azure Policy evaluates Azure resources against rules you define. It can audit (report non-compliance), deny (block resource creation), or automatically remediate (fix existing resources). It is the primary tool for enforcing governance across a large Azure estate.

Policy effects in order of strength:

Disabled:    Policy exists but does not evaluate anything
Audit:       Non-compliant resources are flagged in compliance reports
             but creation is not blocked
AuditIfNotExists: Audit if a related resource does not exist
             (e.g. audit VMs that do not have the monitoring extension)
Append:      Automatically add a field to the resource request
             (e.g. add a required tag with a default value)
Modify:      Add, update, or remove resource properties or tags
             (e.g. enforce tag values on existing resources)
DenyAction:  Block specific management operations
Deny:        Block resource creation or modification entirely
DeployIfNotExists: Deploy a related resource if it does not exist
             (e.g. deploy the Log Analytics agent on every new VM)

Policy Initiative (Policy Set):

Group multiple policies into one initiative for easier assignment.
Example: "CIS Microsoft Azure Foundations Benchmark" initiative contains
100+ individual policies.

az policy set-definition list --query "[?policyType=='BuiltIn'].displayName" \
  --output table | grep -i CIS

Common policy patterns:

# Require a specific tag on all resources
{
  "if": {
    "field": "tags['Environment']",
    "exists": "false"
  },
  "then": { "effect": "deny" }
}

# Restrict VM SKUs to approved sizes
{
  "if": {
    "allOf": [
      { "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
      { "field": "Microsoft.Compute/virtualMachines/sku.name",
        "notIn": ["Standard_D2s_v5", "Standard_D4s_v5", "Standard_D8s_v5"] }
    ]
  },
  "then": { "effect": "deny" }
}

# Auto-deploy Azure Monitor Agent on new VMs
{
  "if": { "field": "type", "equals": "Microsoft.Compute/virtualMachines" },
  "then": { "effect": "deployIfNotExists",
    "details": { "type": "Microsoft.Compute/virtualMachines/extensions",
                 "name": "AzureMonitorWindowsAgent" } }
}

Remediation tasks:

For deployIfNotExists and modify policies, you can create remediation tasks to fix existing non-compliant resources retroactively:

az policy remediation create \
  --name remediate-monitor-agent \
  --policy-assignment /subscriptions/SUB/providers/Microsoft.Authorization/policyAssignments/ASSIGNMENT_ID \
  --resource-discovery-mode ExistingNonCompliant

What to say in the interview:

"I use Azure Policy for two things: enforcing standards at deployment time and remediating existing drift. For tagging I use Deny effect so resources cannot be created without required tags — that prevents cost allocation problems from ever being created. For security standards I assign the relevant CIS or regulatory initiative and use the compliance dashboard to track progress over time. For things like monitoring agent deployment I use DeployIfNotExists with a remediation task to backfill existing VMs, rather than waiting for them to be recreated."