AZ-305
Deep Dive
Azure Policy is the CAF's policy-driven governance mechanism: it turns business rules ("only European regions", "every resource must have a cost center tag", "disks must always be encrypted") into automatic guardrails. AZ-305 tests whether you pick the correct effect and the correct scope for each requirement.
Contents
| Mechanism | Controls | Question it answers |
|---|---|---|
| Azure RBAC | WHO can perform WHAT actions | Can this user create VMs in this resource group? |
| Azure Policy | WHAT properties resources can have | Can this VM be a GS5 series? Can it live outside West Europe? |
| Resource Locks | Protection against deletion/modification | Can anyone (even an Owner) delete this resource? |
Design key
Policy and RBAC are complementary and independent: even with the Owner role, a deny policy still blocks you. Policy is evaluated at the control plane (ARM) — it doesn't inspect the data plane (with exceptions like Key Vault and Kubernetes policies).
| Effect | What it does | Typical scenario |
|---|---|---|
| Deny | Rejects the create/update that violates the rule | Block disallowed regions, expensive SKUs, public IPs |
| Audit | Allows it but flags it as non-compliant | Evaluation phase before hardening; visibility without breaking things |
| AuditIfNotExists | Audits if a related resource is missing | VMs without the monitoring extension installed |
| DeployIfNotExists (DINE) | Automatically deploys the missing resource (remediation) | Install the Azure Monitor Agent (AMA), enable diagnostic settings |
| Modify | Alters properties/tags on creation or remediation | Add/inherit tags, enable properties (HTTPS only) |
| Append | Adds fields to the request (legacy, prefer Modify) | Add IP rules to storage accounts |
| Disabled | Disables the rule without removing the assignment | Temporarily pause a policy |
Important for the exam
Assignment scope
An initiative groups multiple policy definitions under a single assignment with shared parameters. Recommended design: assign initiatives, not individual policies — it simplifies management and aggregate compliance reporting.
Key built-in initiatives
Compliance evaluation
How a remediation task works
Exam trap
"Existing VMs don't have the monitoring agent and a deny policy doesn't fix it" — correct, deny only prevents. To install the agent on existing resources you need a DeployIfNotExists policy + a remediation task with a managed identity.
| Requirement | Effect / design |
|---|---|
| Prevent creating resources outside West Europe / North Europe | Deny (allowed locations) at management group |
| Find out which storage accounts allow public access, without breaking anything | Audit |
| Automatically install the AMA agent on new and existing VMs | DeployIfNotExists + remediation task |
| Inherit the CostCenter tag from the resource group to every resource | Modify + remediation task |
| Require the Environment tag when creating any resource | Deny if the tag is missing |
| Demonstrate PCI DSS compliance | PCI DSS regulatory compliance initiative |
| Temporarily exempt a subscription from a policy | Policy exemption with an expiration date |
| Limit VMs to approved SKUs to control costs | Deny (allowed SKUs) |
Did you get this topic?
Test what you just learned
A company requires all VMs (new and existing, across 30 subscriptions) to have the Azure Monitor Agent extension installed. The governance team wants minimal manual effort. What do you design?
Put what you learned to the test with original AZ-305 exam questions.
Start AZ-305 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.