Assign Built-in Policy Initiatives

You’ve built your Azure resources, set up your network, and maybe even deployed your first app. But now the real anxiety kicks in: is your subscription actually secure? Are there storage accounts with public access open to the world? Are your VMs using unapproved images? Manually checking every resource is a nightmare, and a single misconfiguration can have your security team (or your wallet) screaming. That’s exactly why you need to assign built-in policy initiatives in Azure — to stop chasing misconfigurations and let Azure enforce compliance for you.

The problem this lesson solves

Without a solid policy strategy, your Azure environment is a garden where weeds sprout overnight. You might have one storage account that’s properly locked down... and five others that quietly allow anonymous access. You can’t read every JSON template or Azure portal blade every day, but a misconfiguration can lead to data leaks, unhappy auditors, and surprise costs.

Built-in policy initiatives solve this by giving you a pre-packaged, battle-tested set of policies that enforce compliance across your subscription. Instead of writing 50 individual policies from scratch, you assign one initiative — like the Azure Security Benchmark — and instantly get hundreds of checks that run automatically. The result? You go from reactive panic to proactive control.

Core concept / mental model

Think of Azure Policy as the bouncer at your cloud club. Each policy is a single rule: “No public access to storage,” “Only HTTPS for App Services,” “Audit VMs without managed disks.” On its own, one policy is a focused rule.

A policy initiative (also called a policy set) is a collection of these policies that work together toward a bigger goal. Just like a complete security checklist, an initiative bundles dozens of rules into one assignable unit. When you assign an initiative to a scope — a subscription or resource group — you’re telling the bouncer, “Check everyone at the door against this full list.”

Two special terms to know:

• Policy definition: The individual rule (e.g., “Audit insecure TLS settings”).
• Policy assignment: The action of applying that rule to a specific scope (e.g., “Apply this rule to the production resource group”).

Built-in initiatives are maintained by Microsoft, so they’re updated with new regulations and best practices over time. You don’t have to research every compliance framework yourself; Azure hands you the checklist.

How it works step by step

Here’s the flow from zero to compliant:

1. Navigate to Azure Policy — Go to the Azure portal, search for “Policy,” and open the Policy blade.
2. Go to Initiatives — Under the Definitions section, click Initiatives. You’ll see a list of built-in definitions.
3. Pick a built-in initiative — Common ones include Azure Security Benchmark, NIST SP 800-53 R5, and CIS Microsoft Azure Foundations Benchmark. Choose the one that aligns with your compliance needs.
4. Assign the initiative — Click Assign on your chosen initiative. This opens a blade where you’ll define the scope and parameters.
5. Choose scope — Select a subscription or resource group. The broader the scope, the more resources it covers.
6. Configure parameters — Some initiatives let you toggle individual policies on/off or set parameters (like allowed locations). Leave defaults if you’re unsure — they’re safe.
7. Review and create — Click Review + create, then Create. Azure now evaluates all resources in that scope against the initiative’s policies.
8. Monitor compliance — Go to Compliance in the Policy blade to see a live dashboard of compliant vs. non-compliant resources.

The magic is that this runs continuously — every time a resource is created, updated, or deleted, Azure Policy re-evaluates it. It’s not a one-time test; it’s an always-on audit.

Hands-on walkthrough

Let’s assign the Azure Security Benchmark initiative to a resource group in your subscription. This is the most widely used built-in initiative and a great first assignment.

Prerequisites

• An Azure subscription (free trial works)
• The Azure CLI installed and logged in (az login)
• A resource group to assign to (we’ll use rg-policy-lab)

1. Create a resource group (if needed)

az group create --name rg-policy-lab --location eastus

2. Find the initiative definition ID

In the portal, go to Policy > Definitions > Initiatives and look for Azure Security Benchmark. Note its Name (e.g., 1f3afdf9-d0c9-4c3d-847f-89da613e70a8). You can also query it via CLI:

az policy set-definition list --query "[?displayName=='Azure Security Benchmark'].{name:name, displayName:displayName}" -o table

3. Assign the initiative with Azure CLI

# Create a parameter file (optional, but good practice)
cat > initiative-params.json <<EOF
{
  "effect": {"value": "Audit"}
}
EOF

# Assign the initiative to your resource group
az policy assignment create \
  --name "ASB-Assignment" \
  --policy-set-definition "/providers/Microsoft.Authorization/policySetDefinitions/1f3afdf9-d0c9-4c3d-847f-89da613e70a8" \
  --scope /subscriptions/<subscription-id>/resourceGroups/rg-policy-lab \
  --params initiative-params.json

Pro tip: Replace <subscription-id> with your actual subscription ID (find it with az account show --query id -o tsv). If you want to see the assignment in action, create a storage account with public access allowed — it will show as non-compliant within minutes.

4. Verify the assignment

Check that your assignment exists:

az policy assignment list --scope /subscriptions/<subscription-id>/resourceGroups/rg-policy-lab -o table

5. View compliance

In the portal, go to Policy > Compliance. Find your assignment and click it to see which resources are non-compliant and which specific policies they violated (e.g., “Storage accounts should restrict network access”).

Expected output: Your assignment shows up, and compliance dashboard reports 0% compliant (if you have resources without the required settings). That’s okay — it means the initiative is working!

Compare options / when to choose what

Azure offers several built-in initiatives, each tailored to different compliance goals. Here’s how to choose:

When to go custom

If none of the built-ins fit your exact needs, you can create your own initiative by combining custom or built-in policies. But start with built-ins — they’re free, maintained, and comprehensive. Only go custom when you have a unique regulatory requirement.

Pro tip: You can assign multiple initiatives to the same scope. For example, assign Azure Security Benchmark for security and a custom initiative for your org’s tagging standards. They can overlap without conflict.

Troubleshooting & edge cases

Even a simple assignment can trip you up. Here are the most common issues:

• “Authorization failed” error — Your account needs the Microsoft.Authorization/policyAssignments/write permission. As a subscription Owner, you’re fine; as a Contributor, you may need to ask an admin for a role like Resource Policy Contributor.
• Initiative doesn’t show any compliance data — Compliance evaluation can take up to 30 minutes after assignment. Wait, then refresh the portal.
• Assignment succeeded but no resources are covered — Check your scope. If you assigned to a resource group, only resources in that exact group are evaluated — not sub-resource groups or sibling groups.
• Specific policies in the initiative are flagged as “Not started” — Some policies require a remediation task (e.g., fixing a misconfigured VM). Wait a bit; if it persists, check the policy definition to see if it’s Audit or Deny only.
• You accidentally assigned the wrong initiative — Don’t panic. You can delete the assignment and create a new one. Go to Policy > Assignments, select your assignment, and click Delete — the underlying resources are unaffected.
• Parameters are confusing — Most built-ins have sensible defaults. For education, leave everything default and just assign. You can fine-tune later.

What you learned & what's next

You now know how to assign built-in policy initiatives — the art of enforcing compliance at scale without writing a single policy yourself. You’ve learned:

• Why manual audits are a ticking time bomb, and how initiatives automate compliance.
• The mental model of policies as rules and initiatives as checklists.
• How to assign an initiative via the Azure portal or CLI, step by step.
• How to pick the right built-in initiative for your needs.
• How to troubleshoot the most common assignment pitfalls.

Your next step? Create a custom policy initiative tailored to your organization’s specific requirements. That way, you can enforce your own tagging standards, regulatory rules, or cost controls — moving from consumer to creator of Azure Policy.

Now go assign your first initiative — your future self (and your security auditor) will thank you.