Compliance & Governance Audit

Purpose

Assess the governance posture of Azure subscriptions by auditing policies, RBAC assignments, tagging standards, resource locks, and regulatory alignment. Produce a compliance scorecard with remediation steps.

Procedure

Step 1: Azure Policy compliance

az policy state summarize --query "value[].{policy:policyDefinitionName, nonCompliant:nonCompliantResources}" -o table

Report total policies assigned, % compliant, and top 5 violated policies.

Step 2: RBAC review

az role assignment list --all --query "[].{principal:principalName, role:roleDefinitionName, scope:scope}" -o table

Flag: > 3 Owners at subscription level, Contributor sprawl, classic admins, guest users with privileged roles, stale assignments (90+ days inactive), overly broad custom roles.

Step 3: Tagging compliance

Check mandatory tags (environment, owner, cost-center, application):

az resource list --query "[?tags.environment==null || tags.owner==null].{name:name, type:type, rg:resourceGroup}" -o table

Report % of resources with all mandatory tags and top offending resource groups.

Step 4: Resource locks

az lock list --query "[].{name:name, level:level, resource:resourceId}" -o table

Verify production databases, storage accounts, and networking resources have delete locks.

Step 5: Naming conventions

Analyze resource naming patterns against Azure naming conventions (rg-, vnet-, vm-, st, kv-). Report % compliance.

Step 6: Network governance

Check for public endpoints that should be private, NSG flow logs, Network Watcher in all active regions, DDoS protection.

Step 7: Diagnostic settings

az monitor diagnostic-settings subscription list --subscription <id> -o table

Verify logs flow to a central Log Analytics workspace.

Scoring

Sample output

References

• Azure Policy: https://learn.microsoft.com/en-us/azure/governance/policy/overview
• RBAC Best Practices: https://learn.microsoft.com/en-us/azure/role-based-access-control/best-practices
• Resource Tagging: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-resources
• Resource Locks: https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/lock-resources
• Naming Conventions: https://learn.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-best-practices/naming-and-tagging