Fortunately Microsoft makes enforcing policies relatively straightforward via a service called Azure Policy. It combines a number of best practice, out-of-the-box policies with the ability for you to also create your own custom policy definitions. You can setup guardrails and enforce compliance easily.

The best bit? Aside from Azure Arc resources, Azure Policy is available free of charge.

Setting up policies

Once you have an active Azure subscription, the first thing you’ll want to do is sign in to the Azure portal and open the ‘Policy’ service. You can find this by searching for ‘Policy’.

If you haven’t setup any policies and you have no provisioned resources, you should see a dashboard showing a 100% compliance rate. Otherwise the dashboard may show you issues that require attention with your provisioned resources.

The ‘Getting Started’ tab allows you to quickly setup policy assignments for your cloud environment. This includes things such as blocking the provision of various resource types or requiring tags on resources.

The ‘Getting Started’ tab for Azure Policy

Alternatively you can select “Definitions” under “Authoring” and browse the complete list of policy definitions that can be applied.

Before configuring a policy, consider whether you want to retrospectively apply a policy to existing Azure resources or whether it should only apply to new resources being provisioned.

By default policies only apply to new resources, but you can update existing resources after the policy has been assigned.

Once you select a policy, you can configure the following:

• Scope: The tenant, management group, subscription (optional) and resource group (optional) that the policy will apply to

• Basics: The policy definition, assignment name and brief description of the policy. You can also specify whether the policy is enforced or disabled, and see who assigned the policy

• Parameters: Some policies may require additional parameters. For example, the ‘Not allowed resource types’ policy requires you to select the types of resources you want to prohibit from being provisioned

• Remediation: If you’re deploying a policy with the deployIfNotExists and modify effect types you’ll need to provide a managed identity that can be used to edit tags and deploy resources where required. You may also need to configure role permissions

• Non-compliance message: Message to show when a resource or modification is denied due to the policy, or if a resource is presently non-compliant

Where needed, provide Azure policy parameters

Monitoring compliance

Once you’ve configured your policies, the “Compliance” tab will update to show resources and their compliance state.

The list of resources shown can be filtered by scope (management group, subscription, resource group or resource type), definition type (all, initiative or policy), compliance state (such as compliant, non-compliant, not registered) and by name or ID.

Sometimes when trying to run an ARM template in a new subscription to create Azure resources, customers come across the following error:

MissingSubscriptionRegistration: The subscription is not registered to use namespace 'Microsoft.Web'

The namespace may be different depending on the resources you’re trying to create - but effectively this error is telling you that for your subscription, you cannot create resources belonging to the aforementioned namespace. In the case of this example, that’s Microsoft.Web - specifically an App Service.

By default, a new subscription will have most resource providers disabled as a precautionary security measure. You can see a full list of default enabled providers here.

By having most providers disabled, compromised accounts are unable to create a raft of resources. Therefore it’s critical that you only enable namespaces you need to use.

Normally deploying an ARM template should automatically enable the resource namespace - but sometimes it doesn’t work as expected. Similarly, creating a resource manually in the Azure portal should also automatically enable the resource namespace.

Fixing this error is quite straightforward, assuming you have owner or contributor access to the subscription. If you don’t, you’ll need to get your IT administrator to make these changes on your behalf.

Open the Azure Portal, navigate to Subscriptions and choose the subscription you’re trying to deploy the ARM template into. Then, go to Resource providers in the sidebar.

Now scroll through the list of all resource providers until you see the one mentioned in the error message you received. Click the namespace to highlight it, and then choose Register from the menu bar.

This will now activate the namespace, allowing you to create resources that reside within it and thereby the error will be resolved.

Note however that the namespace may not be activated immediately - you may need to wait up to 15 minutes before running the ARM template deployment again.

The registering status shows in the portal while the namespace is being activated - so a quick refresh of the page will allow you to see when the work is completed.