The difference between Azure Policy and Role-based access control

I had an interesting discussion with a customer today, trying to explain the difference between Azure Policy and Azure role-based access control (RBAC). Both are a way to secure access to your Azure environment but serve a different purpose. In this post, I\’ll try to explain the difference between both.

Azure Policy

Azure Policy is a way to validate and enforce policies against your Azure environment. Azure Policy is a policy engine that is built-into the Azure API. It effectively allows you to do 3 things:

• Monitor the actual state of your Azure infrastructure vs the policies you have configured. This allows you to get an understanding of the current state of everything that is deployed in Azure and understand which resources are not compliant with your policies. This monitoring happens once every 24 hours.
• Deny the creation of resources that are not compliant with the policies you\’ve configured. The deny would happen at resource creation time.
• Alter the resource that is being created to make it compliant. This is different from the deny statement: a deny statement would block the creation of the resource, whereas altering the resource allows you to make changes to the resource before it is deployed. The change would happen at resource creation time.

Policies can be assigned at different scopes: management group, subscription, or resource group. You can define more than 1 policy, and apply the same policy at different scopes. When a resource is created, all policies applying to that resource will be evaluated. If one of the policies includes a deny statement, the creation will be blocked. If one or more policies include a change, all those changes will be applied to the resource.

Policies are a set of restrictive rules, that control what can be deployed in your Azure environment. They do not control who gets access to your environment, that is controlled through role-based access control.