Azure Policy: built-in vs custom definitions, initiatives, effects (Deny, Audit, Modify, DeployIfNotExists), remediation tasks, exemptions

Azure RBAC controls who can act; Azure Policy controls what resources may look like. A policy definition is a rule written in JSON with an if condition (for example, a storage account where supportsHttpsTrafficOnly is false) and a then effect. You assign the definition to a scope (management group, subscription or resource group), optionally excluding child scopes, and Azure evaluates matching resources on create and update and periodically for compliance.