Manage identity, access, and governance
Security Governance and Compliance
CoreTurn security intent into enforceable policy, role, lock, backup, and infrastructure-as-code controls while using Defender for Cloud to assess and remediate drift.
Aligned to the live SC-500 guide, which publishes no skills-measured date; guide and product behavior verified September 23, 2026.
Why this matters
Governance controls operate at different layers. Policy can deny or deploy configuration, RBAC grants actions, locks protect resources from management-plane change, and Defender for Cloud turns standards into posture evidence.
Must Know
- Azure Policy definitions describe conditions and effects; initiatives group definitions, assignments set scope, and exemptions document approved exceptions.
- Defender for Cloud regulatory compliance maps assessments to standards. A failed control requires investigating the underlying resources and recommendations.
- Security standards and recommendations express desired posture; workload protection alerts indicate detected threats and are not compliance scores.
- CanNotDelete and ReadOnly locks apply to management-plane operations and inherit to child resources; they do not replace data-plane authorization.
- Use built-in roles when they fit. Custom roles need precise actions, data actions, assignable scopes, and change control.
- Backup security includes soft delete, immutability where supported, authorization protections, alerts, and separation of backup administration from workload administration.
- Infrastructure as code should encode policy, identity, networking, diagnostics, and secure defaults so deployments are repeatable and reviewable.
Compare and Distinguish
- Policy governs allowed or required configuration; RBAC governs who may perform operations; locks block classes of management-plane change.
- Regulatory compliance summarizes mapped assessments; an individual recommendation identifies a concrete resource risk.
- A built-in role is maintained by Azure; a custom role is customer-defined and must be maintained as services evolve.
Scenario examples
- Scenario: New storage accounts must deny public access while existing accounts are remediated. Think: assign appropriate policy effects and create a managed-identity remediation task where required.
- Scenario: Operations may update a VM but must not delete its resource group. Think: use a deletion lock at the correct scope without granting extra roles.
- Scenario: A pipeline repeatedly deploys resources without diagnostics. Think: put the requirement into policy and the infrastructure definition rather than relying on a manual checklist.
Exam traps
- A policy assignment does not retroactively fix an existing noncompliant resource unless the effect and remediation support it.
- A resource lock can block an authorized administrator but cannot stop a data-plane operation such as deleting a blob.
- Owner at a broad scope can create role assignments; a narrow service-specific role usually cannot.
- Removing a recommendation from view does not remediate the underlying configuration.
Key takeaways
- Choose the governance layer that actually controls the stated operation.
- Treat compliance as evidence to investigate, not proof that every workload is secure.
- Make secure configuration repeatable in policy and infrastructure code.
How it works
- Azure Resource Manager evaluates policy and authorization at scoped operations, while Defender for Cloud aggregates assessment results.
- Remediation, locks, backup protections, and templates add corrective and recovery layers around that evaluation.
Objects and administrative surfaces
- Azure Policy definitions, initiatives, assignments, remediation tasks, exemptions, and compliance results.
- Defender for Cloud environment settings, security standards, recommendations, regulatory compliance, and governance rules.
- Azure IAM role definitions and assignments, resource locks, Recovery Services or Backup vault security, and deployment templates.
When to use it
- Use built-in policy and roles first; create custom definitions only for a documented gap.
- Use Defender for Cloud to prioritize posture work and infrastructure as code to prevent configuration drift.
Security and governance implications
- Review exemptions, custom roles, broad assignments, policy changes, and backup security settings as privileged changes.
- Keep deployment code and policy definitions under version control with approval and rollback.
Troubleshooting signals
- For policy noncompliance, inspect definition effect, assignment scope, exemption, evaluation time, and remediation identity.
- For denied management operations, evaluate RBAC, deny assignments, policy, and inherited locks separately.
More detail
- Author or select policies and initiatives with suitable effects and scope.
- Interpret Defender for Cloud standards, recommendations, and compliance assessments.
- Choose built-in or custom roles and remove overprivileged assignments.
- Protect backups and encode secure controls in deployment definitions.
Ready for the quiz?
- When does a policy assignment need a remediation task and managed identity?
- What can a resource lock protect that RBAC alone does not guarantee?
- Which fields make a custom role dangerously broader than intended?
Related objectives
- D1.3.S1 — Implement and configure security controls by using Azure Policy, including built-in and custom policy definitions
- D1.3.S2 — Evaluate regulatory compliance by using Microsoft Defender for Cloud
- D1.3.S3 — Implement and configure security controls in Defender for Cloud, including security standards and recommendations
- D1.3.S4 — Implement resource locks
- D1.3.S5 — Manage Azure built-in role assignments
- D1.3.S6 — Manage custom roles, including Azure roles and Microsoft Entra roles
- D1.3.S7 — Evaluate and remediate overprivileged access assignments by using Azure role-based access control (RBAC)
- D1.3.S8 — Configure security controls for backup protection by using Azure Backup security features
- D1.3.S9 — Implement and configure security controls by using infrastructure as code