The problem
One pattern appears more often than it should when I’m reviewing an Azure estate. A consultant came in, deployed a smart-looking Azure Policy framework, wrote a handover document, and left. Six months later the customer had policies, but when I asked why those policies existed, how to raise an exception, or how to change one as the estate grew, I got a shrug. The controls were there. Nobody governed them. Meanwhile a shadow AI project had spun up and routed straight around the lot, because no one was watching the assignments or the exemptions. And the compliance blade? A reassuring wall of green that proved almost nothing. That’s the difference between having Azure Policy and managing it, and most organisations are on the wrong side of it.
Minimal Viable Policy
My starting position is deliberately small. I deploy only the policies an organisation can understand and actively manage today — not a comprehensive framework that looks impressive on handover and then rots for two years. A handful of controls the team can explain, audit and change will beat a sprawling initiative that nobody owns and nobody dares to touch. Every time.
Ownership is the part people skip. Policy belongs to the Governance and Security teams — not operations, and certainly not whichever consultant happens to be in the room this quarter. Those teams then use the assessments they should already be running — Well-Architected reviews and governance check-ins — to look at what’s in place, retire what no longer fits, and expand only where there’s a real need and someone to carry it. If you’re a Microsoft partner taking over a customer’s estate, you’ll recognise the opposite: a pile of policies deployed by someone long gone, with no owner and no record of why.
Small policies earn their keep in three ways: they’re easier to audit, easier to troubleshoot at 2am when something breaks, and easier to evolve as the estate grows — which is why they scale where big frameworks stall. And it ties straight back to the Strategy phase of the Cloud Adoption Framework: governance is a discipline you practise, not a deliverable you receive, and you can’t manage what you never defined a purpose for.
From black box to managed system
To keep this honest, I use Microsoft’s Enterprise Policy as Code (EPAC). It takes your definitions and assignments out of the portal — where they get clicked in once and forgotten — and into a repository that’s version-controlled, testable, and reviewed through pull requests. That’s the real difference between a policy black box and a managed system: every change has an author, a reason, and a history. EPAC shows you drift, and exactly what moved and when, and that visibility is what creates accountability. It’s also how a Minimal Viable Policy grows into a full governance practice without starting over.
Where to start
Running Azure with governance you can’t quite account for? You’re not alone, and it is fixable. We’ll help you define your Minimal Viable Policy, put real ownership behind it, and grow it as your estate does. Book a consultation to talk it through, or get your environment reviewed — I’ll tell you what your policies actually enforce, and what they only look like they do.