How to Audit Azure Resources with a Built-In Azure Policy

Azure Policy lets you define rules for your cloud resources and see at a glance which ones break them. The quickest way to learn it is to assign a built-in policy in audit mode: nothing gets blocked, but every non-compliant resource shows up in a compliance report. This guide walks through assigning a built-in definition in the Azure portal, reading the results, and cleaning up.

Before you start

• An Azure account with permission to create policy assignments on the scope you choose.
• A resource group with at least one virtual machine to evaluate. The example below audits VMs that don’t use managed disks, so a VM that doesn’t use managed disks will show up as non-compliant.

Step 1: Open Azure Policy

1. Sign in to the Azure portal.
2. Search for Policy and select it.
3. On the Policy pane, select Assignments, then Assign Policy.

Step 2: Set the basics

On the Basics tab:

• Scope: choose the subscription and, for a safe first test, a single resource group.
• Exclusions and resource selectors: optional. Skip them for a first assignment.
• Policy definition: open the list and add the built-in definition Audit VMs that do not use managed disks.
• Version: accept the default (1.*.*) unless you need to pin a version.
• Assignment name: defaults to the policy name. Change it if you want a clearer label, and add a description if it helps your team.
• Policy enforcement: leave it Enabled. This definition only audits, so existing resources aren’t changed.

Step 3: Review parameters, remediation, and messages

1. Parameters tab: set any parameters the definition needs. This one has none.
2. Remediation tab: leave the managed identity unchecked for an audit-only policy. You must check it for policies that use the DeployIfNotExists or Modify effects, because those can change resources.
3. Non-compliance messages tab: add a plain-language message such as “Virtual machines should use managed disks.” Users see it when a resource is denied or found non-compliant, so make it actionable.

Step 4: Create the assignment

On the Review + create tab, check the details and select Create.

Step 5: Check compliance

1. Back on the Policy pane, select Compliance and find your assignment.
2. Give it a few minutes. Results for a brand-new assignment don’t appear instantly.
3. Resources that break the rule show a state of Non-compliant. Select the assignment name to see which resources are affected.

Step 6: Clean up the test

If this was only a trial, remove the assignment so it doesn’t linger: on Compliance or Assignments, select the ellipsis (...) next to the assignment and choose Delete assignment.

Tips for real deployments

• Start with audit effects, then move to enforcement once you know what the policy catches.
• Write clear non-compliance messages. They turn a failed deployment into a fixable one.
• Assign at the narrowest scope that makes sense first, then widen it.
• Only enable the managed identity on the Remediation tab when a policy genuinely needs to modify or deploy resources.

Sources

• Quickstart: Create a policy assignment to identify non-compliant resources using Azure portal – Microsoft Learn