Identity and data governance: privileged access, reviews, entitlement, lifecycle.
Policy against RBAC, locks, deny assignments, Defender for Cloud and machine configuration. Which control answers which question, and the restraint that keeps an assignment count manageable.
Export the estate, structure the repository, and deploy a definition change through a workflow that reads compliance before it lets enforcement flip. No framework, so the mechanics stay visible.
Definitions in source control, assignments by pipeline, test scopes under DoNotEnforce, and an honest read on the tooling from raw export through the landing zone accelerators to EPAC.
A compliance standard assigned and read properly: your controls separated from Microsoft's, the manual half attested with evidence and an expiry, and a coverage statement that can accompany the number.
A compliance standard assigned as an initiative measures a partial view by Microsoft's own account, blends your controls with theirs, and is still formally a preview feature.
Nine compliance states, an evaluation clock that runs from five minutes to twenty-four hours, and a percentage that can rise because you stopped looking at something.
One deny rule walked from audit in a single region to enforced across the estate, with the compliance gate stated before each widening and the rollback written beside the step that needs it.
A policy change is a production change. Enforcement mode, resource selectors, effect overrides and version pinning exist so a deny reaches your most critical tier last, on purpose.
