Azure Policy CLI

az policy assignment create

Deploy Azure Policy assignments with the CLI, applying subscription governance (allowed resources, configuration) as code.

Run it in the infrastructure pipeline when you want Azure governance as code: az policy assignment create assigns the policy (built-in or custom definitions) to the scope (subscription, resource group) — non-compliant resources (disallowed types, mandatory configuration, tags) are detected (or blocked). It's Azure governance via the CLI (or IaC): versioned policies deployed with the pipeline. In Azure DevSecOps, policies are the governance layer: the assignment created with the CLI (or in Bicep/Terraform) and non-compliant resources detected.

Don't use it without definitions: the assignment requires the policy definition (Azure built-ins or custom) — the definition is reviewed before assignment. And note: the policy effect (audit vs. deny) defines behavior: audit logs (non-compliant resources) and deny blocks — the assignment is deployed with the effect appropriate to the environment. The cost of policies (continuous evaluation) is sized. For IaC deployment, policies in Bicep/Terraform; the CLI is for ad-hoc management.