Governance at Scale: Enforcing Network Security Baselines with Azure Policy & La

This session makes the case for "guardrails, not gates": governance that's built into the platform itself rather than bolted on afterward.

We'll start with Azure Policy fundamentals, including policy definitions, initiatives, and effects (Deny, Audit, DeployIfNotExists, Modify), and explore how each effect type is appropriate for different governance scenarios.

From there, we move into practical network security baselines, covering policies that:

• Deny public IP creation on VMs
• Enforce mandatory NSG association on subnets
• Require specific Azure Firewall routing
• Mandate encryption in transit

The session then zooms out to the Cloud Adoption Framework Landing Zone model, showing how these individual policies are assembled into a coherent governance architecture and applied automatically at subscription vending time. This ensures every new subscription inherits the right guardrails from day one, rather than having security retrofitted later.

We'll also cover:

• Management group hierarchy design
• Policy assignment scope
• Handling policy exemptions for legitimate edge cases without undermining the overall baseline