Configuring Initiatives

Configuring initiatives in Azure Policy lets you bundle related policy definitions into a single policy set (initiative) and assign that set to a scope. This simplifies governance by deploying and managing a coherent set of rules—examples include required tags, inherited tags, allowed VM SKUs, allowed resource types, and allowed locations. Below is an example parameter we might expose at the initiative level to drive multiple policies:

Parameter ID	Parameter name	Parameter value
`listOfAllowedLocations`	`listOfAllowedLocations`	`["eastus","westus"]` (user-defined)

Other typical policies to include: allowed resource group locations, allowed resource types, require tags, inherit tags, allowed VM SKUs, and so on. Grouping these under an initiative makes consistent enforcement easier.

A presentation slide titled "Azure Policy – Use cases" showing a colorful central diagram and a ring of icons. It lists policy examples such as allowed resource types, resource group locations, VM SKUs, required/inherited tags, and allowed locations.

Create an initiative definition in the Azure portal

Steps to create an initiative definition:

In the Azure portal, navigate to Policy → Definitions → + Initiative definition.
Choose where to store the initiative: a management group or a subscription.
Provide a descriptive name and description for the initiative.

Example: create an initiative named “KodeKloud Standard Policies” to represent your organization’s baseline governance rules.

A Microsoft Azure portal screenshot showing the "Initiative definition" form for creating a policy initiative. The form is filled with "Initiative location: IT", name "KodeKloud Standard Policies", and a description field saying "Set of policies for Kodekloud."

Add policies to the initiative and organize them

Add multiple policy definitions to the initiative such as:
- Require a tag and specific value on resource groups
- Allowed virtual machine SKUs
- Allowed resource types
- Inherit a tag from the resource group
Optionally create groups within the initiative (for example, a “Tags” group and a “Compute” group). Grouping improves readability in the initiative UI and helps administrators quickly find related policies.

When adding policies, you can map each policy to a group name in the initiative UI to organize them logically.

A Microsoft Azure portal screenshot showing an initiative definition titled "KodeKloud Standard Policies" with a list of policies (Require a tag, Allowed VM size SKUs, Allowed resource types, Inherit a tag, etc.). A notification toast in the corner indicates the initiative definition was successfully saved.

Define and map initiative parameters

Initiatives can expose parameters that feed the included policy definitions. Define initiative-level parameters when you create or edit the initiative, or override them at assignment time. Common initiative parameters:

Parameter	Purpose	Example values
Tag Name	Which tag is required/inherited	`Environment`
Tag Value	Required tag value (if enforced)	`PoC`
Allowed VM SKUs	Limit selectable VM sizes	`Standard_B1s`, `Standard_B1ms`
Allowed resource types	Restrict which resource types can be created	`Microsoft.Compute/virtualMachines`, `Microsoft.Storage/storageAccounts`

Set these values to ensure consistent policy inputs across all included policy definitions.

A screenshot of the Microsoft Azure portal showing an "Initiative definition" on the Policy parameters tab, with fields like Tag Name (Environment), Tag Value (PoC) and an open dropdown for Allowed virtual machine size SKUs (showing options such as Standard_B2ats_v2). The bottom of the page shows action buttons: Review + create, Cancel, Previous, and Next.

A screenshot of the Microsoft Azure portal showing the "Initiative definition" → "Policy parameters" page with parameter rows (Tag Name, Tag Value, Allowed Size SKUs, Allowed resource types) and values like "Environment" and "PoC" set. Navigation buttons such as Review + create, Cancel, Previous, and Next are visible at the bottom.

Review and save the initiative definition. Important: saving creates the initiative object but does not enforce it until you assign it to a scope.

Assign the initiative to a scope

To enforce the initiative, assign it to a scope (management group, subscription, or resource group):

Select the initiative and click Assign.
Choose the scope where the initiative should be enforced and optionally set exclusions.
Configure any assignment-specific parameter overrides, remediation settings, and policy enforcement mode.

Keep in mind:

An initiative definition is stored at a particular location (management group or subscription). That storage location determines where it can be assigned. For example, an initiative created at a management group can be assigned to subscriptions under that management group.
For broad enforcement across the tenant, create the initiative at the tenant root management group.

A Microsoft Azure portal screenshot showing the "KodeKloud Standard Policies" policy assignment page with the Basics tab open, including fields for Scope, Exclusions, Assignment name, and Policy enforcement. A right-hand Scope pane overlays a subscription dropdown with "Kodekloud - AZ500 - POC" available to select.

You can narrow an assignment to specific subscriptions or to a single resource group if you want targeted enforcement.

A Microsoft Azure portal screenshot showing the "KodeKloud Standard Policies" policy assignment page, with scope, exclusions, and assignment details on the left and a Scope pane on the right for selecting a management group, subscription, and resource group. The resource group dropdown is open, showing options like "az-demo-rbac" and "NetworkWatcherRG."

Click Review + create and then Create to start the assignment. It can take several minutes for assignment creation and initial evaluation to complete.

A screenshot of the Microsoft Azure portal showing the "KodeKloud Standard Policies" assignment Review + create page with basics like scope, policy definition, and enforcement status. A notification pop-up in the top-right says the initiative assignment is being created.

Some policy effects (for example, policies that add or modify tags, like “Inherit a tag from resource group”) require the policy’s managed identity to have permissions to update resources. Azure will automatically create role assignments (for example, Tag Contributor) for the policy identity so it can take corrective actions during remediation.

After assignment completes, the portal shows the initiative assignment and the compliance status. Initially you may see 0% compliance and several non-compliant resources while Azure evaluates existing resources.

A screenshot of the Microsoft Azure Policy portal showing an overview with overall resource compliance at 0% and a red donut chart indicating four non-compliant resources. A Notifications pane on the right reports recent successful role and initiative assignment events.

Testing the initiative — common enforcement examples

Require a tag and a specific value on resource groups

Policy: resource groups must have a tag named Environment with value PoC. Creation without that tag (or with a different value) will be denied.

Example of the API error when creating a resource group that violates the tag policy:

{
  "error": {
    "code": "RequestDisallowedByPolicy",
    "target": "azpolicy-check-rg",
    "message": "Resource 'azpolicy-check-rg' was disallowed by policy.",
    "additionalInfo": [
      {
        "type": "PolicyViolation",
        "info": {
          "evaluationDetails": {
            "evaluatedExpressions": [
              {
                "result": "True",
                "expressionKind": "Field",
                "expression": "type",
                "path": "type",
                "expressionValue": "Microsoft.Resources/subscriptions/resourceGroups",
                "targetValue": "Microsoft.Resources/subscriptions/resourceGroups",
                "operator": "Equals"
              },
              {
                "result": "True",
                "expressionKind": "Field",
                "expression": "tags[Environment]",
                "path": "tags[Environment]",
                "expressionValue": "prod",
                "targetValue": "PoC",
                "operator": "NotEquals"
              }
            ]
          }
        }
      }
    ]
  }
}

If the required Environment: PoC tag is present, the resource group creation will validate successfully.

Allowed resource types

Policy: only resources listed in allowedResourceTypes (for example, Microsoft.Compute/virtualMachines, Microsoft.Storage/storageAccounts) can be created in-scope.
Attempting to create a disallowed resource (for example, Microsoft.Network/virtualNetworks) will be blocked and the portal shows a policy denial.

A screenshot of the Microsoft Azure portal on the "Create virtual network" page showing a validation failed banner. The error pane states the resource "demo-vnet-4" was disallowed by policy (RequestDisallowedByPolicy).

Allowed virtual machine sizes (SKUs)

Policy: limit VM sizes to a small set (for example, B-series SKUs). During VM creation the size picker is filtered and only allowed SKUs are selectable; other sizes appear as blocked.

A screenshot of the Microsoft Azure portal on the "Select a VM size" page showing a list of virtual machine sizes, their vCPUs, RAM, storage/IOPS and monthly costs. The table highlights B-Series and DS-series options with estimated prices.

Inherit tag from resource group

Policy: inherit the Environment tag value from the resource group onto resources created inside it. Because this remediation uses the policy’s managed identity, Azure creates the necessary role assignment so the policy can add tags on resources.
After creating a storage account or other allowed resource in the resource group, you should see Environment: PoC present on the resource.

Putting this together

Initiatives (policy sets) let you group related policies and manage them as a single unit, with shared parameters and a single assignment.
Use initiatives to ensure consistent governance across multiple subscriptions or resource groups.
Policies evaluate resource requests and existing resources and can deny actions or perform remediation, depending on the policy effect.

Policy vs. RBAC — what’s the difference?

Aspect	Azure Policy	Role-Based Access Control (RBAC)
Purpose	Enforce resource configuration and compliance (allowed types, SKUs, tags, locations, etc.)	Grant permissions to perform management actions (create, delete, modify) on resources
When applied	During resource deployment and evaluation of existing resources	At the time of user/API action based on assigned roles
Effect types	Deny, Audit, Modify (remediation), DeployIfNotExists, Disabled	Grant or deny management operations based on roles
Typical use case	Prevent creation of unsupported resources, require tags, enforce SKUs	Allow administrators, developers, or operators to perform specific operations (e.g., VM Contributor)

In short: RBAC controls who can do what; Azure Policy controls what can be deployed and how resources are configured.

Links and references

Azure Policy documentation: https://learn.microsoft.com/azure/governance/policy/
Azure role-based access control (RBAC): https://learn.microsoft.com/azure/role-based-access-control/

Introduction

Administer Identity

Administer Governance and Compliance

Administer Azure Resources

Administer Virtual Networking

Administer Intersite Connectivity

Administer Network Traffic

Administer Azure Storage

Administer Azure Virtual Machines

Administer PaaS Compute Options

Administer Data Protection

Administer Monitoring

Configuring Initiatives

Create an initiative definition in the Azure portal

Add policies to the initiative and organize them

Define and map initiative parameters

Assign the initiative to a scope

Testing the initiative — common enforcement examples

Putting this together

Policy vs. RBAC — what’s the difference?

Links and references

Watch Video

​Create an initiative definition in the Azure portal

​Add policies to the initiative and organize them

​Define and map initiative parameters

​Assign the initiative to a scope

​Testing the initiative — common enforcement examples

​Putting this together

​Policy vs. RBAC — what’s the difference?

​Links and references

Watch Video

Create an initiative definition in the Azure portal

Add policies to the initiative and organize them

Define and map initiative parameters

Assign the initiative to a scope

Testing the initiative — common enforcement examples

Putting this together

Policy vs. RBAC — what’s the difference?

Links and references