Security wants several house rules—HTTPS on storage, no anonymous blobs, and Key Vault firewall—assigned once across the canal estate. Which Azure Policy construct should you use?
Select an answer to reveal the explanation.
Short Explanation
An initiative is the binder: drop HTTPS-on-storage, no-anonymous-blobs, and Key Vault firewall into one set and assign it once. Twenty loose policies drift like twenty sticky notes.
Full Explanation
An initiative (policy set) bundles related policy definitions—such as HTTPS-only storage, disallow anonymous blob access, and Key Vault network/firewall expectations—into one assignable unit. The canal authority assigns the initiative once at the right MG or subscription scope instead of maintaining twenty independent assignments that drift. Creating many unrelated one-off assignments increases operational toil and inconsistent parameters. Microsoft Defender for Cloud Secure Score recommendations are useful signals but are not a substitute for formal Policy assignments that enforce or audit continuously. Publishing rules only in a wiki with annual reviews fails continuous compliance. Exam caveat: initiatives still need thoughtful parameters, effects, and exclusions; bundling does not remove the need to choose Deny versus Audit per definition. Operational check: create or use a built-in initiative that matches the storage and Key Vault baseline, assign it at the canal MG, remediate or exempt with documented tickets, and compare compliance before/after to show the binder reduced drift versus loose policies. One initiative assignment also simplifies evidence packages when auditors ask how storage and Key Vault baselines are enforced together.