Contoso Azure Policy

Enterprise-Scale Landing Zone · Cloud Adoption Framework

Governance guardrails, aligned to the
Well-Architected Framework

An opinionated, deployable Azure Policy baseline for Contoso Ltd. Custom definitions, WAF-aligned initiatives, and management-group assignments — shipped as code with an Audit-first, Deny-later rollout model.

Explore the catalog Deploy it
0
Policy definitions
0
WAF initiatives
0
MG assignments
0
Management groups

Five pillars, one baseline

Every policy is tagged to a Well-Architected Framework pillar and rolled up into a per-pillar initiative.

Enterprise-scale management group hierarchy

Guardrails assign at management-group scope so every current and future subscription inherits compliance.

Policy catalog

Filter by pillar or search. Each policy ships parameterized effects defaulted to a safe value.

Deploy in three steps

Portal, CLI, or CI/CD. The orchestrator creates definitions, initiatives, and scoped assignments.

  1. 1

    Authenticate

    Sign in and target the Contoso intermediate root management group.

  2. 2

    Deploy the hierarchy

    Optionally stand up the management-group tree with Bicep (tenant scope).

  3. 3

    Apply the baseline

    Run the orchestrator to create definitions, initiatives, and assignments.

# 1. Authenticate
az login
az account set --subscription "<platform-mgmt-sub-id>"

# 2. Deploy the management group hierarchy (tenant-scoped)
az deployment tenant create `
  --name contoso-mg-hierarchy `
  --location eastus `
  --template-file management-groups/hierarchy.bicep

# 3. Deploy definitions, initiatives & assignments
./scripts/deploy.ps1 -RootManagementGroupId contoso -Location eastus -WhatIf
# 1. Authenticate
az login
az account set --subscription "<platform-mgmt-sub-id>"

# 2. Deploy the management group hierarchy (tenant-scoped)
az deployment tenant create \
  --name contoso-mg-hierarchy \
  --location eastus \
  --template-file management-groups/hierarchy.bicep

# 3. Deploy definitions, initiatives & assignments
./scripts/deploy.sh --mg contoso --location eastus --what-if

Rollout model: onboard in Audit → measure 2–4 weeks → remediate → promote the assignment effect to Deny → time-box any exemptions.

Deployment wizard

Enter your Azure specifics to generate a ready-to-run script that signs in with device code, pulls the baseline definitions, and assigns your selected initiatives with your parameters. Everything runs in your browser — no input leaves this page.

1 Target & sign-in
2 Guardrail parameters
3 Posture & scope

Initiatives to assign

Runs az login --use-device-code against your tenant, clones this repo for the policy definitions, then assigns your selected initiatives. Requires the Azure CLI and Git. Review the script before running.