Azure Policy drift is what happens when your cloud slowly moves away from the rules you set for it, even though nobody broke those rules on purpose. You pass the audit in March. The compliance dashboard glows green. By September, a quiet pile of exceptions, manual fixes and new resources has pushed the environment somewhere else, and the dashboard may not tell you.
If you look after Microsoft Azure for a living, you have probably lived this. This guide explains why Azure Policy drift happens, how to spot it early, and what a lasting fix looks like. It also points to the training that helps Australian cloud teams make the habit stick.
What Is Azure Policy Drift?
Azure Policy lets you write rules, group them into initiatives and assign them to a management group, subscription or resource group. Microsoft describes it as a way to enforce organisational standards and assess compliance at scale. That is the theory.
Azure Policy drift is the gap between the compliant state you designed and the state your resources are in today. It is a close cousin of configuration drift in Azure, but wider. It covers the resources, the assignments, the exemptions and the policies themselves. In practice it shows up in three ways:
- Resource drift. A resource changes after deployment, and nobody notices.
- Assignment drift. A new subscription or management group sits outside the policies everyone assumes apply.
- Definition drift. The policies go stale because Azure keeps adding services, properties and resource types.
Why a Compliant Environment Does Not Stay Compliant
Azure Policy is not a force field. It behaves more like a security guard who checks the building at set times. Between those checks, and in the gaps the guard cannot see, things change. Here is where Azure Policy drift usually starts.
Evaluation happens at specific moments
Azure Policy evaluates resources when they are created or updated, when an assignment is added or changed, and during the standard compliance cycle that runs once every 24 hours. You can also trigger an on-demand scan. The point is that the compliance report is the result of the last completed evaluation. It is not a live feed, so Azure Policy drift can sit unseen until the next cycle.
Deny only protects the future
A Deny effect blocks new or updated resources that break the rule. It does nothing about the thousand resources that already existed when you assigned it. Audit simply reports. Modify and DeployIfNotExists can fix resources, but existing ones need a remediation task before anything changes. Many teams assign the policy, see a long list of non-compliant resources, and move on. That backlog is Azure Policy drift waiting to be noticed.
Exemptions that never expire
Every team needs an exception now and then. The trouble starts when the exemption has no owner and no end date. Six months later nobody remembers why it exists, and the resource behind it has quietly become part of production.
Coverage gaps in the hierarchy
A subscription created outside the management group structure never inherits your policies. An initiative assigned at the wrong scope covers only part of the estate. Some resource properties are not exposed to Azure Policy at all, so no rule can check them. Each gap lets Azure Policy drift grow in the dark.
People under pressure
At 2am during an incident, the fastest fix is a portal click. It works, the incident closes, and the change never gets written back to code. Add broad Owner and Contributor access and you have a steady stream of small, well-meaning changes.
Infrastructure as code and reality disagree
Bicep and Terraform describe how things should look. The live environment can still differ from those files. If nobody compares the two on a schedule, drift in the code and Azure Policy drift in the cloud feed each other.
The cloud keeps moving
Azure releases new services and new properties constantly. An initiative you built last year does not automatically understand a resource type launched this year. Definition drift is the slowest kind, and often the one auditors find first.
A Simple Example of Azure Policy Drift
Here is a hypothetical scenario. A retail company in Sydney assigns a policy that denies public access on storage accounts. A vendor needs a file urgently on a Friday afternoon, so an engineer creates a temporary exemption for one storage account. The vendor gets the file. The exemption stays.
Over the following months, the team stores more data in that account because it is convenient. The dashboard still shows 97% compliant, because one exempt resource barely moves the number. At the next audit, that single account becomes the headline finding. Nothing was hacked and no rule was ignored. Azure Policy drift did the work on its own.
How to Detect Azure Policy Drift Early
You cannot fix what you cannot see. These habits make Azure Policy drift visible while it is still small:
- Trigger an on-demand scan after big changes. Do not wait for the daily cycle after a migration or a new assignment. For a resource group, the Azure CLI command looks like this:
az policy state trigger-scan –resource-group <your-resource-group>
- Query the data yourself with Azure Resource Graph. A simple query shows which policies produce the most non-compliant resources:
policyresources
| where type == ‘microsoft.policyinsights/policystates’
| where properties.complianceState == ‘NonCompliant’
| summarize count() by tostring(properties.policyDefinitionName)
| order by count_ desc
- Review exemptions every month. List them, check the owner and make sure each one has an expiry date.
- Use Microsoft Defender for Cloud. Its regulatory compliance view maps your results to standards, which helps when someone asks how you are tracking against a framework.
- Alert on policy changes. Azure Activity Log alerts and Event Grid can tell you when an assignment is deleted or a compliance state changes.
- Compare code to live. Run Terraform plan or Bicep what-if on a schedule and treat any difference as a finding.
Microsoft’s page on getting compliance data covers the evaluation triggers and reporting options in more detail.
How to Fix and Prevent Azure Policy Drift
Detection is half the job. Prevention is where the real gains are. A practical order of attack:
- Move from Audit to Deny, in stages. Start with Audit to learn what would break, then switch to Deny once the noise is under control.
- Use Modify and DeployIfNotExists with remediation tasks. Run remediation regularly so existing resources catch up with the rules.
- Assign at management group level. Build on an Azure landing zone design, such as the one in the Cloud Adoption Framework, so new subscriptions inherit policy from day one.
- Treat policy as code. Keep definitions and assignments in Git, deploy them through GitHub Actions or Azure DevOps, and require a pull request for every change.
- Reduce standing access. Use least privilege and Privileged Identity Management so portal changes are deliberate, not casual.
- Give every exemption an owner and an expiry date. No exceptions to this rule.
- Track the trend, not one score. A weekly count of non-compliant resources tells you more than a single percentage.
Azure Policy Drift and Australian Compliance
Australian organisations face extra pressure here. Government and critical infrastructure teams work towards the ACSC Essential Eight, financial services firms answer to APRA CPS 234, and public sector projects often need IRAP assessments. Azure Policy and Defender for Cloud can produce useful evidence for these frameworks. They do not make you compliant on their own, and a drifting environment weakens that evidence quickly. Controlling Azure Policy drift is as much an audit-readiness habit as a technical one.
Skills That Stop Azure Policy Drift
Tools matter, but people close the loop. Teams that understand governance, identity and automation catch drift early. These Azure certification courses build exactly those skills:
- AZ-900 Azure Fundamentals covers governance, compliance and cloud concepts, and suits managers and new starters.
- AZ-104 Microsoft Azure Administrator teaches the day-to-day governance, monitoring and resource management that keeps policy healthy.
- AZ-500 Azure Security Technologies builds the security posture and compliance skills behind Defender for Cloud.
- AZ-305 Azure Solutions Architect focuses on designing governance models and landing zones that resist drift.
- AZ-400 Microsoft DevOps Solutions covers the pipelines and automation behind policy as code.
Not sure where to begin? The Azure certification roadmap and the Azure certification comparison guide help you pick a path, and you can browse every option on the Azure certifications page. If you are weighing up the career side, read our posts on avoiding cloud skills and legacy IT skills.
Azure Training in Melbourne, Sydney, Brisbane and Beyond
Azure Certifications AU runs instructor-led Azure training with hands-on labs, mock tests and trainer support. Find your city:
- Azure certification training in Melbourne
- Azure certification training in Sydney
- Azure certification training in Brisbane
- Azure certification training in Perth
- Azure certification training in Adelaide
- Azure certification training in Canberra
Prefer to learn from your desk, or want a private session for your team? Live online and in-house options are available too. See all training locations, or call 1300 649 299 to talk it through.
Azure Policy Drift FAQs
What is Azure Policy drift?
Azure Policy drift is the gradual gap between the compliant state you designed and the real state of your Azure resources, assignments and exemptions.
How often does Azure Policy evaluate resources?
Azure Policy evaluates resources when they are created or updated, when assignments change, and once every 24 hours in the standard cycle. You can also run an on-demand scan.
Can Azure Policy fix drift automatically?
Partly. Modify and DeployIfNotExists can correct resources, but existing resources need a remediation task. Deny only blocks new or updated resources.
Which Azure course covers Azure Policy?
AZ-104 and AZ-305 cover governance directly, AZ-500 extends it into security, and AZ-900 introduces the concepts.
Final Thoughts
A compliant cloud is not a finished project. It is a habit. Azure Policy drift will always try to creep in, through shortcuts, exemptions and new services. Detect it early, fix it with automation, and make sure your team has the skills to run the process. Ready to build those skills? Contact our team about Azure training near you.