A reviewer wants to turn off Azure Policy assignments because Defender for Cloud regulatory compliance is enabled. What is the accurate guidance?
Select an answer to reveal the explanation.
Short Explanation
Defender’s compliance board is the report card; Azure Policy is still the hall monitor with the deny stick. Turning Policy off because the dashboard looks pretty leaves the estate unenforced.
Full Explanation
Accurate guidance for the reviewer is to keep Azure Policy as the enforcement engine; Defender for Cloud regulatory standards report assessments and are often backed by Policy. The compliance dashboard is the report card; Policy assignments (including deny/deploy effects) remain how the canal estate blocks non-compliant deployments.
Removing Azure Policy entirely once any Defender standard shows a green control abandons enforcement because a green assessment is a point-in-time report, not a substitute for continuous guardrails. Claiming Defender standards replace Azure Policy as the enforcement engine for deny effects overstates what regulatory compliance dashboards do—they assess and report; Policy enforces. Keeping only Policy initiative assignments and never enabling Defender regulatory standards ignores the assessor-friendly mapped reports Defender provides, even though Policy remains necessary for enforcement.
Exam caveat: some Defender recommendations correspond to Policy definitions/initiatives; turning Policy off can also degrade how assessments are evaluated or remediated automatically.
Operational check: inventory critical Policy assignments at the management group, confirm Defender regulatory standards are enabled where needed, and prove a deny Policy still blocks a non-compliant test deployment while the Defender dashboard continues to report the related control.