OOPROJECT SYSTEM / CLOUD POLICY COMPLIANCE← PROJECT INDEX
MANAGEMENT GROUP GOVERNANCE · AZURE POLICY · BICEP · REMEDIATION
PROJECT / 03SYSTEM ONLINE

CLOUD POLICY
COMPLIANCE DASHBOARDAzure governance that can detect, visualize, alert and automatically restore compliance.

A full Azure governance observability platform built at management-group scope. Custom policies and a Cloud Governance Baseline are deployed as code, non-compliance is visualized through a workbook, Azure Monitor alerts notify stakeholders, and policy remediation hardens Storage Accounts and returns the environment to compliant state.

BICEP GOVERNANCE AS CODEMG-PLATFORM INITIATIVERESOURCE GRAPH + WORKBOOKLOG ANALYTICS TELEMETRYAZURE MONITOR ALERTSMANAGED IDENTITY REMEDIATION
START PROJECT STORY ↓ARCHITECTUREGALLERYVALIDATION FLOWENGINEERING DEEP DIVE ↗
● SCOPE / MG-PLATFORM + LEARNINGCLOUD SUBSCRIPTION● SIGNAL / WORKBOOK + POLICY STATE + ALERT HISTORY● OUTCOME / DETECT → ALERT → REMEDIATE → COMPLIANT
GOVERNANCE / CONTROL SURFACELIVE POLICY LIFECYCLE
● ACTIVE
Cloud Policy Compliance Dashboard architecture
SCOPEMG-PLATFORM
VISIBILITYWORKBOOK
RESPONSEMODIFY
GitHub → Bicep
→ mg-platform initiative
→ rg-governance-core
→ Azure Resource Graph
→ Azure Workbook
→ Azure Monitor Alert
→ Action Group
→ Policy Remediation
→ Storage hardened
→ Compliance restored
VIEW SOURCE REPOSITORY ↗
01 / OVERVIEW

WHAT THIS PLATFORM SOLVES.

In many Azure estates, policy exists but operations stop at basic auditing. This project turns governance into an operational platform: standards are defined as code, drift is surfaced visually, alerts notify stakeholders, and remediation can restore compliant configuration.

THE BASELINE

MANAGEMENT-GROUP GOVERNANCE INSTEAD OF ONE-OFF SUBSCRIPTION CHECKS.

A custom Cloud Governance Baseline initiative is assigned at mg-platform. A dedicated governance resource group hosts the workspace, workbook, action group, and alert rules.

  • Custom policy definitions and initiative deployed with Bicep.
  • Initiative assigned at management-group scope with managed identity.
  • Governance workspace centralized in rg-governance-core.
  • Workbook, alerts, and remediation operationalize policy state.
THE FINISHED STORY

A FULL GOVERNANCE LIFECYCLE, NOT JUST COMPLIANCE REPORTING.

A non-compliant Storage Account is detected, visualized, used to fire an alert, and then automatically remediated. The setting changes, compliance returns to 100%, and the workbook reflects a clean state.

DETECTVISUALIZEALERTREMEDIATERESTORE COMPLIANCE
02 / BUSINESS IMPACT

GOVERNANCE THAT MOVES FROM PASSIVE REPORTING TO OPERATIONAL RESPONSE.

  • Standardized governance across Azure environments by deploying reusable policy definitions, initiatives, and assignments as code.
  • Reduced cloud misconfiguration risk by detecting risky Storage Account settings through Azure Policy at management-group scope.
  • Improved compliance visibility through an Azure Workbook using Azure Resource Graph PolicyResources for live compliance state, with Log Analytics supporting operational telemetry and investigation.
  • Reduced manual reporting effort with audit-ready compliance views, affected resources, and policy results in one dashboard.
  • Improved operational response through Azure Monitor alerts and Action Group email notification.
  • Reduced remediation effort using Azure Policy modify remediation with managed identity.
  • Proved the complete lifecycle: detect, visualize, alert, remediate, and verify compliance restored to 100%.
03 / GOVERNANCE CONTROLS

HOW THE CONTROLS WORK TOGETHER.

Policy enforces the standard. Azure Resource Graph exposes live policy compliance state to the Workbook. Diagnostic settings stream Activity Log data into Log Analytics for operational telemetry and investigation. Azure Monitor alerts react to drift, while remediation uses the assignment identity to correct a real resource property.

DETECTION + VISIBILITY
  • Custom audit policy flags risky Storage Account configuration.
  • Azure Resource Graph PolicyResources provides live policy compliance state.
  • Workbook visuals show non-compliance and affected resources.
  • Activity Log diagnostic settings stream Policy events into Log Analytics for investigation.
RESPONSE + CORRECTION
  • Azure Monitor alerting reacts to non-compliance.
  • Action Group email proves the notification path.
  • Managed identity is attached to the initiative assignment.
  • Modify remediation sets allowBlobPublicAccess = false.
04 / AZURE ARCHITECTURE

FROM GIT PUSH TO RESTORED COMPLIANCE.

The flow follows the real build: Bicep deployment, management-group policy, centralized governance resources, live policy-state detection through Azure Resource Graph, workbook visualization, operational telemetry through Log Analytics, alerting, managed-identity remediation, and final verification.

CONTROL-PLANE FLOW
01

GitHub repository + Bicep modules

Management group and subscription templates

The repo holds custom policy definitions, initiative wiring, assignment logic, workbook JSON, KQL queries, and subscription-scope governance modules.

02

mg-platform baseline deployment

Azure Policy at management-group scope

Bicep deploys the custom audit policy, remediation policy, and Cloud Governance Baseline initiative to mg-platform, then assigns it with a system-assigned managed identity.

03

rg-governance-core observability layer

Subscription scope

A governance resource group hosts the Azure Workbook, Log Analytics workspace, Action Group, and alerting resources. Workbook compliance views query Azure Resource Graph PolicyResources, while Log Analytics supports operational telemetry and investigation.

04

Diagnostic settings + Policy states

Activity Log to workspace

Subscription Activity Log categories, including Policy, are streamed to the workspace for validation and investigation.

05

Alerting + remediation

Azure Monitor + Azure Policy modify

Alert rules monitor policy state data, action groups deliver notifications, and remediation tasks correct eligible storage properties.

VALIDATION FLOW
01

Create a non-compliant Storage Account

Blob public access and exposure settings create a real policy violation.

02

Force policy scan

The resource appears as NonCompliant in Azure Policy and workbook queries.

03

Validate alerting

The alert fires, appears in history, and sends Action Group email.

04

Grant assignment identity RBAC

Contributor is granted at subscription scope for modify remediation.

05

Run remediation and verify

allowBlobPublicAccess becomes false and policy returns to compliant.

CONTROL SURFACE / GOVERNANCE LIFECYCLEDETECT → VISUALIZE → ALERT → REMEDIATE
Repository
   ↓
Bicep deployment
   ↓
mg-platform / Cloud Governance Baseline
   ↓
Azure Policy compliance state
   ↓
Azure Resource Graph / PolicyResources
   ↓
Azure Workbook
   ↓
Non-compliance detected
   ↓
Azure Monitor Alert
   ↓
Action Group Email
   ↓
Managed Identity Remediation
   ↓
Storage setting hardened
   ↓
100% compliant

Operational telemetry path:
Azure Activity Log
   ↓
Diagnostic Settings
   ↓
Log Analytics
   ↓
Validation + Investigation
06 / VALIDATION WALKTHROUGH

HOW THE PLATFORM WAS TESTED END TO END.

This simulation mirrors the real validation sequence: deploy, create drift, detect it, alert on it, remediate it, and verify the restored configuration.

GOVERNANCE CONTROL RUNDETECT → ALERT → REMEDIATE
01

Deploy management-group baseline

Bicep deploys custom policy definitions, initiative, and assignment to mg-platform.

READY
02

Deploy governance resources

rg-governance-core receives the workspace, workbook, action group, and alert rules.

WAITING
03

Create violating Storage Account

A deliberately risky configuration produces a real policy violation.

WAITING
04

Force policy scan

Policy state becomes NonCompliant and the workbook shows the affected resource.

WAITING
05

Validate alerting

The non-compliance alert fires and Action Group email is delivered.

WAITING
06

Execute remediation

The assignment-managed identity runs a modify remediation task.

WAITING
07

Verify property change

allowBlobPublicAccess changes to false.

WAITING
08

Confirm compliance restored

Policy state returns to compliant and the workbook clears.

WAITING
07 / TECH STACK

AZURE-NATIVE GOVERNANCE AND OPERATIONS BUILDING BLOCKS.

CONTROL PLANE
  • Azure Policy custom definitions
  • Management-group policy initiative
  • Bicep management-group and subscription deployments
  • Managed identity policy assignment
OBSERVABILITY + RESPONSE
  • Azure Resource Graph PolicyResources
  • Azure Workbook compliance visualization
  • Log Analytics workspace for operational telemetry and investigation
  • Azure Monitor alerting
  • Action Group email notification
  • Azure Policy remediation tasks
08 / PROJECT SNAPSHOT

CLOUD POLICY COMPLIANCE / SYSTEM STATE.

ASSIGNMENT SCOPEmg-platform management group
GOVERNANCE RGrg-governance-core
WORKSPACElaw-governance-core
WORKBOOK SOURCEAzure Resource Graph / PolicyResources
TELEMETRYActivity Log → Log Analytics
ALERT PATHPolicy state → Azure Monitor → Action Group email
REMEDIATION TARGETStorage Account blob public access disabled automatically
FINAL STATEWorkbook clear, policy 100% compliant
09 / CHALLENGES & LESSONS

WHAT BROKE — AND HOW IT WAS FIXED.

The strongest engineering value came from real troubleshooting across policy state queries, workbook behaviour, alerting, assignment identity, and modify remediation.

01Workbook query failed because the wrong table name was used+

The first workbook and alert queries targeted PolicyResources directly. The working path used arg("").PolicyResources for workbook and alert use.

  • Symptom: workbook tile error and alert query resolution failure.
  • Fix: switch to arg("").PolicyResources and redeploy workbook JSON.
  • Outcome: donut, table, and alert logic aligned to the same live policy-state source.
02Activity-based alerting looked correct in theory but failed in practice+

An AzureActivity-based path was explored, but it did not validate consistently enough for the management-group scenario.

  • Symptom: activity alert deployed but did not produce dependable history.
  • Fix: retain the validated policy-state non-compliance alert as the primary evidence path.
  • Outcome: the final project story stayed aligned to what was actually proven.
03The first remediation design targeted the wrong property+

The remediation definition was redesigned around allowBlobPublicAccess because it produced a clean modify-based correction and a verifiable configuration change.

  • Symptom: accepted remediation with no useful deployments or unchanged resource.
  • Fix: set allowBlobPublicAccess = false through Azure Policy modify.
  • Outcome: remediation succeeded and the storage setting changed automatically.
04Remediation required assignment identity and RBAC+

Modify remediation depended on a system-assigned identity on the management-group initiative assignment plus adequate subscription-scope RBAC.

  • Fix: recreate the assignment with managed identity.
  • Grant Contributor at subscription scope for the lab remediation path.
  • Outcome: remediation executed successfully and restored compliance.