In Azure, you can create policies where you can define and enforce rules and actions for your Azure resources. Azure policies differ from RBAC because this is not about users, groups, or applications that need access, but Azure policies are about applying your organization's governance strategy. Azure can scan your resources, so they stay compliant with company rules and SLAs. For instance, you can create a policy that evaluates all virtual machines that use Managed Disks.
For creating policies, users must be granted the owner role in RBAC, or a custom role needs to be created where the following permissions need to be added to the JSON file:
- To define policies: Microsoft.Authorization/policydefinitions/write
- To assign policies: Microsoft.Authorization/policyassignments/write
Policies can be created using the Azure Portal, PowerShell, and CLI.
...
