Policy as Code

Problem

Your company says: “Production storage must never be publicly accessible.” A developer can accidentally enable public network access while deploying a storage account, so the rule needs enforcement during deployment.

Solution — Policy as Code

Azure Policy represents rules as JSON conditions and effects, assigned to a scope such as a subscription. For example, a rule targets storage accounts and requires publicNetworkAccess to equal Disabled; violations trigger the deny effect. When someone creates or updates an account through the portal or a deployment pipeline, Azure Resource Manager evaluates the policy and rejects requests that violate it. Existing violations appear as non-compliant and require a separate fix. The policy files and assignments can live in Git, where changes are reviewed and deployed through a pipeline. Storage public network access enabled?

     ↓
Yes → deny
No  → allow

Core idea: policy as code turns organizational rules into automatically evaluated controls.