Governance, Compliance & Privacy

This module covers the tools and services that help you maintain control, consistency, and compliance across your Azure environment. You'll learn how to enforce rules with Azure Policy, protect critical resources with Locks, and govern data with Microsoft Purview. We'll also explore how to manage hybrid and multi-cloud environments with Azure Arc and how to ensure your organization meets its compliance obligations.

Azure Policy

Azure Policy is a service that allows you to create, assign, and manage policies to enforce organizational standards and assess compliance at scale. It helps ensure that your resources stay compliant with your corporate standards and service level agreements.

In Plain English

Azure Policy = guardrails. It does not deploy anything; it sets the rules of the road (e.g., "only deploy in EU regions", "all storage must be encrypted"). When someone tries to break a rule, Policy can deny the action or simply log it.

Policy Component	Description	Example
Policy Definition	A rule with a specific condition and an effect.	A rule stating, 'Allowed locations for resources are East US and West US'.
Initiative (or Policy Set)	A collection of related policy definitions grouped together.	An initiative for 'HIPAA Compliance' that includes policies for encryption, auditing, and location restrictions.
Assignment	The application of a policy or initiative to a specific scope (management group, subscription, or resource group).	Assigning the 'HIPAA Compliance' initiative to the 'Healthcare-Prod' subscription.
Effect	The action taken when the rule is violated. Effects include Deny (block a non-compliant action), Audit (log the violation), and DeployIfNotExists (automatically deploy a required resource).

Exam Tip

The Deny effect is proactive: it prevents non-compliant resources from being created. Audit is reactive: it flags existing resources that are not compliant.

Azure Resource Locks

Resource Locks provide a way to protect Azure resources from accidental deletion or modification. A lock can be applied to a subscription, resource group, or individual resource and is inherited by all child resources.

Even a user with the Owner role cannot delete or modify a locked resource without first removing the lock. This provides an essential safeguard against mistakes.

Lock Type	Can Read?	Can Modify?	Can Delete?	Use When...
CanNotDelete	Yes	Yes	No	You want to prevent deletion but allow changes, such as for a production database.
ReadOnly	Yes	No	No	You want the resource to be completely immutable, such as a critical networking hub.

Microsoft Purview

Microsoft Purview is a unified data governance service that helps you manage and govern your on-premises, multi-cloud, and software-as-a-service (SaaS) data. It creates a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage.

In Plain English

Purview = the librarian for all your data. It scans your storage accounts, databases, and SaaS apps, then builds a searchable catalog so people can find data, see where it came from, and know whether it contains sensitive info like credit-card numbers.

Purview Capability	What It Does
Data Map	Automatically scans and catalogs data assets across your entire data estate.
Data Catalog	Provides a searchable catalog for data consumers to find trustworthy and valuable data.
Data Classification	Automatically identifies sensitive information like credit card numbers, personal IDs, and health records using built-in and custom classifiers.
Data Loss Prevention (DLP)	Helps identify and prevent the unsafe sharing of sensitive information.

Trust, Privacy, and Compliance Resources

Microsoft provides several resources to help you understand its security and compliance posture.

• Microsoft Service Trust Portal: The public-facing site for publishing audit reports and other compliance-related information. Here, you can find reports like ISO 27001, SOC 2, and FedRAMP, which demonstrate how Microsoft manages security and data protection for its cloud services.
• Compliance Manager: A feature within the Service Trust Portal that helps you manage your organization's compliance activities. It provides a risk-based score and actionable recommendations for meeting data protection regulations.
• Azure Privacy Statement: This document explains what personal data Microsoft processes, how Microsoft processes it, and for what purposes.

Azure Arc

Azure Arc extends Azure's management plane to resources that live outside of Azure. It allows you to manage Windows and Linux servers, Kubernetes clusters, and databases hosted on-premises, at the edge, or in other clouds (like AWS and GCP) as if they were native Azure resources.

With Azure Arc, you can apply Azure Policy, use Azure Monitor, and enforce security with Microsoft Defender for Cloud across your entire hybrid environment from a single control plane.

Azure Blueprints

Azure Blueprints allow you to package and deploy a repeatable set of Azure resources and governance artifacts. A blueprint can include resource groups, ARM templates, policy assignments, and role assignments.

In Plain English

Blueprints = a recipe for a fully governed environment. Where Policy sets one rule and ARM templates deploy one set of resources, a Blueprint bundles resources + policies + role assignments together so a new project can be spun up "compliant by default" in minutes.

When a new project starts, you can use a blueprint to rapidly deploy a new, well-governed environment that is consistent with organizational standards from day one. You can also version and update blueprints, providing a clear audit trail for your environment configurations.