Quick Note — Recommend a Solution for Managing Compliance
AZ-305 › Unit 1 › Design governance › Recommend a solution for managing compliance
Quick Note — Recommend a Solution for Managing Compliance
Compliance in Azure is not a one-time project — it is a continuously enforced design constraint. This lesson walks you through the architect's toolbox for answering a single exam-style question: "Contoso must comply with ISO 27001 across all production subscriptions. What do you recommend?" You will learn to compose Azure Policy, Microsoft Defender for Cloud, management groups, Deployment Stacks, and Template Specs into a design that auto-enforces, audits, and reports on compliance without relying on human vigilance.
Retrieval target
- Recommend a Solution for Managing Compliance
- Closed-book recall
- 5 minutes
- Open the full lesson after a miss
Decision anchors
| Prompt | Compact answer |
|---|---|
Azure Policy | The control-plane service that evaluates resources against rules (policy definitions) and enforces a response (effect) on non-compliant ones. Applied at MG / sub / RG scope; assignments inherit downward. Powers both real-time gating (Deny) and continuous evaluation (Audit, AuditIfNotExists) plus remediation (DeployIfNotExists, Modify). |
Policy definition | A JSON rule with three parts: if (resource matches), then.effect (single response — Deny, Audit, Modify, etc.), and parameters (so one rule can be parameterised at assignment time, e.g., 'allowed regions'). Lives at MG or subscription scope. Assigning the definition to a scope is a separate object — the policy assignment. |
Initiative (policy set) | A grouping of related policy definitions assigned together as one unit. Built-in initiatives back regulatory standards — PCI DSS, HIPAA HITRUST, ISO 27001, UK NHS, Canada Federal PBMM, etc. — each containing dozens of policies. Assigning the initiative to a scope evaluates all child policies in one shot and rolls up to a single compliance percentage. |
Effect: Deny | A policy effect that rejects non-compliant resource create / update requests with HTTP 403. The resource is never created. The most aggressive effect — use only when the rule is universally true (e.g., 'no public blob containers') and you've audited first. Existing non-compliant resources are flagged but not deleted. |
Read the answers once, then cover the right-hand column and reconstruct each one from the prompt. A useful answer names the requirement, the recommended control or service boundary, and the nearest alternative it rejects. If you can only recognize the answer after seeing it, retrieval is not yet secure.
Ninety-second explanation
Without notes, explain:
- What requirement signals this learning objective rather than a neighbouring one?
- Which two solution families are most likely to be compared?
- Which hard constraint eliminates the strongest distractor?
- What identity, network, data, or failure boundary must appear in the design?
- Which operational test would prove the recommendation works?
Then compare your explanation with the full lesson. Record the missing decision rule—not merely the missed product name—in your error log.
When to open the full lesson
Open the curriculum-linked lesson when you cannot explain a comparison, when a scenario depends on a numeric limit or SKU feature, or when the service is on a retirement path. Use current Microsoft Learn documentation for availability, limits, pricing, naming, and migration milestones; the quick note is intentionally compact.
Source and freshness
Derived from the linked AZ-305 lesson and retrieval deck, grounded in both attached course sources. Reviewed 2026-08-02. Current Microsoft documentation controls changing product contracts.