Chapter 6 of 6
Confirm the result#
Run the compliance check after Azure Policy evaluation has produced current states. The module is complete when the assignment exists at the approved scope, uses the recorded effects, and the review owner can explain every non-compliant reference before promotion.
Stop if policy states are missing, stale, or show unexpected resources. Keep the assignment in DoNotEnforce or audit effects until the owner explains the result.
After implementation#
| What remains | Owner |
|---|---|
| Policy initiative, custom SKU policy, assignment, and parameters | Platform policy owner |
| Current policy states and exceptions | Compliance review owner |
| Deployment SKU list and residency exceptions | Data-residency owner |
| Diagnostic workspace and remediation role path | Observability owner and Log Analytics workspace owner |
| Promotion and restore decision | Promotion authority |
Restore through the approved policy change path:
- Change the assignment back to
DoNotEnforceto stop blocking while keeping compliance data. - Change individual effects to
Audit,AuditIfNotExists, orDisabledwhen the owner approves that narrower restore. - Remove the assignment only after the platform policy owner confirms no workflow uses it.
- Remove the custom policy and initiative only after every assignment that references them is gone.
DeployIfNotExists remediation does not undo diagnostic settings. If diagnostic settings need to be removed, the resource owner removes them through the resource's normal change path after checking retention and incident needs.