Azure Policy Skill

This skill provides expert guidance for Azure Policy. Covers troubleshooting, best practices, decision making, architecture & design patterns, security, configuration, integrations & coding patterns, and deployment. It combines local quick-reference content with remote documentation fetching capabilities.

How to Use This Skill

IMPORTANT for Agent: Use the Category Index below to locate relevant sections. For categories with line ranges (e.g., L35-L120), use read_file with the specified lines. For categories with file links (e.g., [security.md](security.md)), use read_file on the linked reference file

IMPORTANT for Agent: If metadata.generated_at is more than 3 months old, suggest the user pull the latest version from the repository. If mcp_microsoftdocs tools are not available, suggest the user install it: Installation Guide

This skill requires network access to fetch documentation content:

• Preferred: Use mcp_microsoftdocs:microsoft_docs_fetch with query string from=learn-agent-skill. Returns Markdown.
• Fallback: Use fetch_webpage with query string from=learn-agent-skill&accept=text/markdown. Returns Markdown.

Category Index

Category	Lines	Description
Troubleshooting	L36-L42	Diagnosing and fixing Azure Policy non-compliance, Machine Configuration deployment issues, and common policy/SDK errors (evaluation failures, assignment problems, and API/CLI issues).
Best Practices	L43-L50	Best practices for safely testing and deploying Azure Policy and Machine/Guest Configuration, including PSDSC behavior changes, impact evaluation, and safe rollout strategies.
Decision Making	L51-L58	Guidance on planning migrations from DSC/Automanage to Machine Configuration/Azure Policy and choosing recommended policy definitions for managing and securing VMs.
Architecture & Design Patterns	L59-L63	Designing Azure Policy-as-Code workflows, integrating with CI/CD, GitOps, and approvals, and structuring policy repos, environments, and automation for scalable governance.
Security	L64-L168	Using Azure Policy and Machine Configuration for security baselines, OS/CIS hardening, MFA enforcement, and mapping/regulatory compliance for many standards (NIST, ISO, PCI, HIPAA, FedRAMP, etc.).
Configuration	L169-L208	Designing, assigning, and managing Azure Policy and Machine Configuration: JSON structures, effects, guest config packages, compliance data, remediation, tags, identities, and exemptions.
Integrations & Coding Patterns	L209-L238	Patterns for writing reusable Azure Policy definitions (operators, fields, effects, tags, initiatives) and integrating/automating them via Terraform, Kubernetes/Gatekeeper, VS Code, Event Grid, and Resource Graph
Deployment	L239-L249	How to deploy and assign Machine Configuration packages via ARM/Bicep/Terraform/REST, publish them to storage, export policy for policy-as-code, and enforce Azure Policy in DevOps pipelines

Troubleshooting

Topic	URL
Troubleshoot Azure Machine Configuration deployments	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/overview/04-operations-troubleshooting
Diagnose causes of Azure Policy non-compliance	https://learn.microsoft.com/en-us/azure/governance/policy/how-to/determine-non-compliance
Troubleshoot common Azure Policy errors and SDK issues	https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general

Best Practices

Topic	URL
Test Machine Configuration packages with GuestConfiguration tools	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/3-test-package
Understand PSDSC behavior changes in Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/whats-new/psdsc-in-machine-configuration
Evaluate impact before deploying new Azure policies	https://learn.microsoft.com/en-us/azure/governance/policy/concepts/evaluate-impact
Apply safe deployment practices to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/how-to/policy-safe-deployment-practices

Decision Making

Topic	URL
Plan migration from Azure Automation DSC to Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/whats-new/migrating-from-azure-automation
Plan migration from DSC extension to Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/whats-new/migrating-from-dsc-extension
Select recommended Azure Policy definitions for VMs	https://learn.microsoft.com/en-us/azure/governance/policy/concepts/recommended-policies
Plan migration from Automanage Best Practices to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/how-to/migrate-from-automanage-best-practices

Architecture & Design Patterns

Topic	URL
Design Azure Policy as Code governance workflows	https://learn.microsoft.com/en-us/azure/governance/policy/concepts/policy-as-code

Security

Topic	URL
Deploy Machine Configuration security baseline policies	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/assign-security-baselines/deploy-a-baseline-policy-assignment
Customize Machine Configuration security baseline parameters	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/assign-security-baselines/specify-custom-parameters-for-baseline-policy
Author JSON parameters for Machine Configuration baselines	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/assign-security-baselines/understand-baseline-settings-parameter
Sign Machine Configuration packages and enforce signed content	https://learn.microsoft.com/en-us/azure/governance/machine-configuration/how-to/develop-custom-package/6-sign-package
Use regulatory compliance initiatives in Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/concepts/regulatory-compliance
Map Australia ISM PROTECTED controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/australia-ism
Map Australia ISM PROTECTED controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/australia-ism
Implement Microsoft cloud security benchmark via Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/azure-security-benchmark
Implement Microsoft cloud security benchmark via Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/azure-security-benchmark
Map Azure Policy to Canada Federal PBMM	https://learn.microsoft.com/en-us/azure/governance/policy/samples/canada-federal-pbmm
Map Azure Policy to Canada Federal PBMM	https://learn.microsoft.com/en-us/azure/governance/policy/samples/canada-federal-pbmm
Azure Policy mappings for CIS Azure 1.1.0	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0
Azure Policy mappings for CIS Azure 1.1.0	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-1-0
Align CIS Azure 1.3.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-3-0
Align CIS Azure 1.3.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-3-0
Align CIS Azure 1.4.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-4-0
Align CIS Azure 1.4.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-1-4-0
Align CIS Azure 2.0.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-2-0-0
Align CIS Azure 2.0.0 controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-azure-2-0-0
Apply CIS benchmarks to AlmaLinux via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/alma-ado
Apply CIS benchmarks to AKS Optimized Azure Linux	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/azure-linux-ado
Apply CIS benchmarks to Debian via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/debian-ado
Apply CIS benchmarks to Oracle Linux via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/oracle-ado
Apply CIS benchmarks to RHEL via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/rhel-ado
Apply CIS benchmarks to Rocky Linux via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/rocky-ado
Apply CIS benchmarks to SUSE Linux Enterprise	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/suse-ado
Apply CIS benchmarks to Ubuntu via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cis-linux/ubuntu-ado
Map CMMC Level 3 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cmmc-l3
Map CMMC Level 3 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/cmmc-l3
Map FedRAMP High controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/fedramp-high
Map FedRAMP High controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/fedramp-high
Map FedRAMP Moderate controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/fedramp-moderate
Map FedRAMP Moderate controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/fedramp-moderate
Implement Gov cloud security benchmark via Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-azure-security-benchmark
Implement Gov cloud security benchmark via Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-azure-security-benchmark
Use CIS Azure 1.1.0 benchmark with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cis-azure-1-1-0
Use CIS Azure 1.1.0 benchmark with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cis-azure-1-1-0
Align CIS Azure 1.3.0 (Gov) controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cis-azure-1-3-0
Align CIS Azure 1.3.0 (Gov) controls with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cis-azure-1-3-0
Map CMMC Level 3 (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cmmc-l3
Map CMMC Level 3 (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-cmmc-l3
Map FedRAMP High (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-fedramp-high
Map FedRAMP High (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-fedramp-high
Map FedRAMP Moderate (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-fedramp-moderate
Map FedRAMP Moderate (Gov) controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-fedramp-moderate
Implement IRS 1075 controls using Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-irs-1075-sept2016
Implement IRS 1075 controls using Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-irs-1075-sept2016
Map ISO 27001:2013 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-iso-27001
Map ISO 27001:2013 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-iso-27001
Align NIST SP 800-171 R2 controls with Azure Policy in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-171-r2
Align NIST SP 800-171 R2 controls with Azure Policy in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-171-r2
Map NIST SP 800-53 R4 controls to Azure Policy in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r4
Map NIST SP 800-53 R4 controls to Azure Policy in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r4
Use Azure Policy to meet NIST SP 800-53 R5 in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5
Use Azure Policy to meet NIST SP 800-53 R5 in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-nist-sp-800-53-r5
Map SOC 2 controls to Azure Policy initiatives in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-soc-2
Map SOC 2 controls to Azure Policy initiatives in Azure Government	https://learn.microsoft.com/en-us/azure/governance/policy/samples/gov-soc-2
Apply CIS Linux security benchmarks via Machine Configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-cis-linux
Use Docker security baseline with Azure Policy guest configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-docker
Use Linux security baseline with Azure Policy guest configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-linux
Apply Windows Server security baseline via guest configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-windows
Apply Windows Server 2025 security baseline via guest configuration	https://learn.microsoft.com/en-us/azure/governance/policy/samples/guest-configuration-baseline-windows-server-2025
Map HIPAA HITRUST controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/hipaa-hitrust
Map HIPAA HITRUST controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/hipaa-hitrust
Azure Policy mappings for IRS 1075 (2016)	https://learn.microsoft.com/en-us/azure/governance/policy/samples/irs-1075-sept2016
Azure Policy mappings for IRS 1075 (2016)	https://learn.microsoft.com/en-us/azure/governance/policy/samples/irs-1075-sept2016
Azure Policy mappings for ISO 27001:2013	https://learn.microsoft.com/en-us/azure/governance/policy/samples/iso-27001
Azure Policy mappings for ISO 27001:2013	https://learn.microsoft.com/en-us/azure/governance/policy/samples/iso-27001
Apply Sovereignty Baseline Confidential policies with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/mcfs-baseline-confidential
Apply Sovereignty Baseline Confidential policies with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/mcfs-baseline-confidential
Policy mappings for Sovereignty Baseline Global	https://learn.microsoft.com/en-us/azure/governance/policy/samples/mcfs-baseline-global
Policy mappings for Sovereignty Baseline Global	https://learn.microsoft.com/en-us/azure/governance/policy/samples/mcfs-baseline-global
Map NIST SP 800-171 R2 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-171-r2
Map NIST SP 800-171 R2 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-171-r2
Map NIST SP 800-53 Rev. 4 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r4
Map NIST SP 800-53 Rev. 4 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r4
Map NIST SP 800-53 Rev. 5 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r5
Map NIST SP 800-53 Rev. 5 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nist-sp-800-53-r5
Map NL BIO Cloud Theme controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nl-bio-cloud-theme
Map NL BIO Cloud Theme controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/nl-bio-cloud-theme
Azure Policy mappings for PCI DSS 3.2.1	https://learn.microsoft.com/en-us/azure/governance/policy/samples/pci-dss-3-2-1
Azure Policy mappings for PCI DSS 3.2.1	https://learn.microsoft.com/en-us/azure/governance/policy/samples/pci-dss-3-2-1
Azure Policy mappings for PCI DSS v4.0	https://learn.microsoft.com/en-us/azure/governance/policy/samples/pci-dss-4-0
Azure Policy mappings for PCI DSS v4.0	https://learn.microsoft.com/en-us/azure/governance/policy/samples/pci-dss-4-0
Align RBI IT Framework for Banks with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rbi-itf-banks-2016
Align RBI IT Framework for Banks with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rbi-itf-banks-2016
Align RBI IT Framework for NBFC with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rbi-itf-nbfc-2017
Align RBI IT Framework for NBFC with Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rbi-itf-nbfc-2017
Map RMIT Malaysia controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rmit-malaysia
Map RMIT Malaysia controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/rmit-malaysia
Map SOC 2 controls to Azure Policy initiatives	https://learn.microsoft.com/en-us/azure/governance/policy/samples/soc-2
Map SOC 2 controls to Azure Policy initiatives	https://learn.microsoft.com/en-us/azure/governance/policy/samples/soc-2
Map Spain ENS controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/spain-ens
Map Spain ENS controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/spain-ens
Map SWIFT CSP-CSCF 2021 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/swift-csp-cscf-2021
Map SWIFT CSP-CSCF 2021 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/swift-csp-cscf-2021
Map SWIFT CSP-CSCF 2022 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/swift-csp-cscf-2022
Map SWIFT CSP-CSCF 2022 controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/swift-csp-cscf-2022
Map UK OFFICIAL and UK NHS controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/ukofficial-uknhs
Map UK OFFICIAL and UK NHS controls to Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/samples/ukofficial-uknhs
Enforce multifactor authentication using Azure Policy	https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/mfa-enforcement