--- title: Learn How to Use Policies as Governance Guard Rails description: Learn how to use Azure Policies as guard rails to support your enterprise governance objectives. image: https://blogs.incyclesoftware.com/hubfs/Guard%20Rails.jpg --- # How to Use Policies as Governance Guard Rails Posted by Phil DeVeau - January 11, 2021 #### The good news is that Azure has built-in governance services that can be used to support the speed of delivery your business demands.  Moreover, while still maintaining a high degree of trust, we can also leverage governance as code to create best in class practices for cloud governance.  - [**](https://www.facebook.com/sharer/sharer.php?u=https://blogs.incyclesoftware.com/enterprise-azure-governance/how-to-use-policies-as-governance-guard-rails) - [**](https://www.linkedin.com/shareArticle?mini=true&url=https://blogs.incyclesoftware.com/enterprise-azure-governance/how-to-use-policies-as-governance-guard-rails&title=&summary=&source=) - [**](https://twitter.com/home?status=) - [**](mailto:?&subject=https://blogs.incyclesoftware.com/enterprise-azure-governance/how-to-use-policies-as-governance-guard-rails&body=https://blogs.incyclesoftware.com/enterprise-azure-governance/how-to-use-policies-as-governance-guard-rails) ** ![header-picture](https://blogs.incyclesoftware.com/hubfs/guardrails-header-web.jpg "header-picture") ### Why Do We Need Guard Rails?  Most organizations have some form of workload in the cloud, whether it is testing the waters or a full end to end solution generating revenue. Organizations and business leaders have become increasingly sophisticated in identifying and managing risks as well as setting goals through using some common IT governance frameworks. Extending those policies out to Azure can be a painful process without the proper guidance to leverage effective tools and strategies.  The good news is that your development staff is invigorated and delivering faster than ever! The bad news is that deployments have slowed to a crawl to ensure that Azure workloads meet the same standards as your on-premises stack. The best news is that Azure has effective governance solutions that can be implemented to meet the speed of delivery your business is demanding while still maintaining a high degree of trust, and we can leverage mature concepts such as governance as code to create best in class practices for expressing your governance practices in the cloud.  ### Naive Data Risk Scenario  A developer getting started in the Azure portal creating a SQL virtual machine can easily, and naively deploy the VM and allows access via HTTP (port 80), HTTPS (port 443), TDS (port 1433), and RDP (port 3389) to anyone with credentials and potentially even with anonymous access. Mission critical proprietary data now has multiple attack vectors! Onsite, this would have been requested through a self-service portal, and the ports would already have been locked down. It is a trivial exercise in Azure to open these ports in the process of creating a VM in the Azure portal. Obviously, we must have the same protections in Azure that we would have on-premises, or we risk putting internal data, and any custodial data at risk.  Policies can help us define some governance guard rails  1. Creating a new policy document 2. Add policy assertions about open ports  3. Add policy assertions about firewalls  4. Add policy assertions about patch levels  5. Assign policy to enable guard rail  We created a simple policy that will make demands during deployment to only allow certain ports to be opened, that all traffic be routed through the azure firewall, and that software patch levels are maintained. This will not only stop an invalid deployment, but the governance policy can also monitor existing deployments, and will continually monitor multiple times per day.  [![Azure Governance Playbook FREE DOWNLOAD](https://no-cache.hubspot.com/cta/default/707613/12e14509-7f97-4632-9ac5-296ad0dc3b81.png)](https://cta-redirect.hubspot.com/cta/redirect/707613/12e14509-7f97-4632-9ac5-296ad0dc3b81) ### Secret Leakage Scenario  Another insidious example, a key vault has been naively created to store secrets securely in the cloud but has not been securely connected to your azure virtual network. With some simply applied policies we can ensure that all key vaults meet rules around virtual network compliance. While the defined steps are the same as the above, with a different set of rules.  Key Vault Policy Example  {      "properties": {          "displayName": "Audit Key Vault Missing VNET",          "mode": "Indexed",          "parameters": {},          "policyRule": {              "if": {                  "allOf": [                      {                          "field": "type",                          "equals": "Microsoft.KeyVault/vaults"                      },                      {                          "anyOf": [                              {                                  "field": "Microsoft.KeyVault/vaults/networkAcls.virtualNetworkRules[*].id",                                  "exists": "false"                              },                              {                                  "field": "Microsoft.KeyVault/vaults/networkAcls.virtualNetworkRules[*].id",                                  "notLike": "*"                              },                              {                                  "field": "Microsoft.KeyVault/vaults/networkAcls.defaultAction",                                  "equals": "Allow"                              }                          ]                      }                  ]              },              "then": {                  "effect": "audit"              }          }      }  }  ### Checklist for Governance  Policies can be codified just like any other deployable artifact, we can even store our policies in source control allowing for discoverability and auditing, changes to policy can follow the same policies that code artifacts will follow and be deployed in much the same manner.  - Do you have management groups defined that match your organization hierarchy?  - Do you have environment and/or product level subscriptions?  - Do you have well defined policies for azure resources that meet your business needs?  - Do you have resource-based access control defined with proper scopes?  - Do you have governance policies checked into source control?  If you cannot answer yes to all the above questions [d](https://www.incyclesoftware.com/playbook-for-modern-enterprise-and-cloud-governance)[ownload our Azure Governance Playbook](https://www.incyclesoftware.com/playbook-for-modern-enterprise-and-cloud-governance) today!  Topics: [Implementation & Adoption](https://blogs.incyclesoftware.com/enterprise-azure-governance/topic/implementation-adoption) [![Modern Enterprise & Cloud Governance Playbook](https://no-cache.hubspot.com/cta/default/707613/e1a05ffb-2e33-417f-8064-4014f1877e61.png)](https://cta-redirect.hubspot.com/cta/redirect/707613/e1a05ffb-2e33-417f-8064-4014f1877e61) --- ### Recent Posts By Michael Spenny - 11 January, 2021 #### Collaborative Cloud Governance: Auditability & Visibility [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/enterprise-azure-governance/collaborative-cloud-governance-auditability-and-visibility) By Michael Spenny - 11 January, 2021 #### How Does the Cloud & Azure Transform Traditional Governance? [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/enterprise-azure-governance/how-does-the-cloud-azure-transform-traditional-governance) By Michael Spenny - 11 January, 2021 #### DevOps Enables Modern Governance [![read more](https://cdn2.hubspot.net/hubfs/685080/IMG-TurboSodium/Sodium%20v2/blog/arrow-recent-blog-post.png "read more")](https://blogs.incyclesoftware.com/enterprise-azure-governance/devops-enables-modern-governance) --- ### Sign-up for Governance Blog Updates # ![Partners Awards List - 2021](https://blogs.incyclesoftware.com/hs-fs/hubfs/PoY%20Award%202021/Partners%20Awards%20List%20-%202021.png?width=748&name=Partners%20Awards%20List%20-%202021.png) # All About Modern Governance InCycle's Modern Governance blog is the result of almost 20 years of industry experience and is ideal reading for medium and large organizations that are trying to navigate cloud adoption and are struggling to design and implement modern governance for either a team, business unit or across the enterprise. The blog is comprehensive and addresses various stakeholders, including operations, security, application development, accounting, and audit. The goal of the blog is to showcase modern governance drivers, new challenges that arise, and to provide actionable guidance for practitioners to complete a modern governance transformation. ### Azure Governance Playbook FREE guidance and tools to complete governance transformation. [![Learn More!](https://no-cache.hubspot.com/cta/default/707613/d0b6969d-3645-4839-ae95-84acb7ca61a2.png)](https://cta-redirect.hubspot.com/cta/redirect/707613/d0b6969d-3645-4839-ae95-84acb7ca61a2) ### Posts by Topic - [Cost Control (5)](https://blogs.incyclesoftware.com/enterprise-azure-governance/tag/cost-control) - [Security (5)](https://blogs.incyclesoftware.com/enterprise-azure-governance/tag/security) - [Structure & Responsibilities (5)](https://blogs.incyclesoftware.com/enterprise-azure-governance/tag/structure-responsibilities) - [Visibility (5)](https://blogs.incyclesoftware.com/enterprise-azure-governance/tag/visibility) - [Implementation & Adoption (4)](https://blogs.incyclesoftware.com/enterprise-azure-governance/tag/implementation-adoption) ### Most Popular Posts ### Blog Archive - [January 2021 (23)](https://blogs.incyclesoftware.com/enterprise-azure-governance/archive/2021/01) - [February 2021 (1)](https://blogs.incyclesoftware.com/enterprise-azure-governance/archive/2021/02) - [**](https://twitter.com/incyclesoftware?lang=en) - [**](https://ca.linkedin.com/company/incycle-software) - [**](https://www.facebook.com/InCycleSoftware/) ### About us At InCycle, we believe there is always a better way and today, that includes the cloud. [![InCycle Microsoft Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Incycle%202017%20website%20resources/logo-InCycle-New-white.png?width=200&name=logo-InCycle-New-white.png "InCycle Microsoft Partner")](https://www.incyclesoftware.com/) ### Learn more - [Why Incycle?](https://www.incyclesoftware.com/why-incycle) - [Success Stories](https://www.incyclesoftware.com/customer-success-stories) - [Events](https://www.incyclesoftware.com/events) - [Careers](https://www.incyclesoftware.com/careers) - [About](https://www.incyclesoftware.com/about-incycle-software)   ### 1-800-565-0510 [info@incyclesoftware.com](mailto:info@incyclesoftware.com)  ### ![Microsoft GitHub Verified Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/GitHub%20Verified%20Partner%20-%20white-SQUARE.png?width=256&height=57&name=GitHub%20Verified%20Partner%20-%20white-SQUARE.png) ![Data & AI Solutions Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Data%20%26%20AI%20Solutions%20Partner.png?width=125&height=144&name=Data%20%26%20AI%20Solutions%20Partner.png) ![Digital & App Innovation Solutions Partner](https://blogs.incyclesoftware.com/hs-fs/hubfs/Digital%20%26%20App%20Innovation%20Solutions%20Partner.png?width=125&height=144&name=Digital%20%26%20App%20Innovation%20Solutions%20Partner.png)   © 2025 InCycle Software [Privacy policy](https://www.incyclesoftware.com/privacy) ** ![](https://px.ads.linkedin.com/collect/?pid=302756&fmt=gif) ![](https://px.ads.linkedin.com/collect/?pid=302756&fmt=gif)