Azure Policy: definitions, initiatives, assignments, scopes and exclusions, effects (Deny, Audit, Modify, DeployIfNotExists) and remediation tasks

Azure Policy enforces rules about what resources may look like, while role-based access control (RBAC) controls who may act. RBAC answers 'can Ana create a VM?'; Policy answers 'is this VM, in this region, with these tags and this size, allowed to exist?'. Policy applies even to Owners, which is what makes it a governance tool rather than a permission system. Organizations use it to keep data in approved regions, require tags for cost reporting, restrict expensive VM sizes and make sure monitoring or security settings are always present.