Key points

• Azure Policy evaluates resource state and can audit, deny, modify, or deploy supported configuration.
• Remediation identities, exemptions, evidence, and ownership are separate parts of an enforceable policy design.

Best-known use cases

• Require diagnostic settings or deny public exposure across existing and future resources at a governing scope.

What candidates often confuse it with

• Azure Policy enforces resource compliance; Azure RBAC determines who may perform operations.

Key takeaway

Choose Azure Policy when resource configurations must be evaluated, prevented, or remediated consistently.

Relevant exam tasks

• D1.3.S1 — Recommend a structure for management groups, subscriptions, and resource groups, and a strategy for resource tagging
• D1.3.S2 — Recommend a solution for managing compliance

Learn more

• Azure Policy overview