AZIAM-007: Azure Policy compliance status
- Platform
- Entra ID / M365
- Category
- Azure IAM & Resource Security
- Severity
- Medium
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 5
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Azure Policy enforces organizational standards and assesses compliance at scale across Azure resources. Non-compliant resources indicate configuration drift from security baselines, potentially exposing the environment to risks that governance controls are designed to prevent. Monitoring policy compliance ensures that deployed resources consistently meet security and regulatory requirements.
Recommended value
All assigned policies should report 95% or higher compliance; non-compliant resources should have documented exceptions
Remediation
Review the Azure Policy compliance dashboard to identify non-compliant resources and prioritize remediation based on policy severity. Use remediation tasks to automatically fix non-compliant resources where supported by the policy effect (DeployIfNotExists, Modify). For resources that cannot be made compliant, create documented policy exemptions with expiration dates and business justification.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| no-data | Not Assessed |
| no-parsed-results | Not Assessed |
| partial-collection | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6
- CIS Azure
- 2.1