Azure Blueprints and Compliance

Azure Blueprints is a service that lets you define a repeatable set of Azure governance artefacts — role assignments, policy assignments, ARM templates, and resource groups — and package them into a single, versioned object. You can then assign the blueprint to a subscription to stand up a fully configured, compliant environment in minutes. Blueprints are designed for enterprises that need to create standardised environments for new projects, teams, or regulatory requirements.

A blueprint is composed of artefacts — the building blocks of the environment it creates. Supported artefact types are: Resource Groups (create resource groups at specific locations as containers for other artefacts), ARM Templates (deploy any Azure infrastructure), Azure Policy Assignments (apply policies with parameters), and RBAC Role Assignments (grant access to specific users or groups). Artefacts can depend on each other and are deployed in the correct order.

Blueprints support versioning, allowing you to maintain multiple published versions simultaneously. When you modify a blueprint, you edit the draft. Once the draft is ready, you publish it as a new version (e.g., v1.0, v1.1, v2.0) with release notes. Existing blueprint assignments retain the version they were deployed with; you can explicitly upgrade an assignment to a newer version. This enables controlled rollout of governance changes across subscriptions.

Blueprints support parameters that allow the same blueprint definition to be customised at assignment time without creating separate blueprints for each variation. Parameters can be defined at the blueprint level and passed down to individual artefacts, or defined directly on each artefact. For example, a parameter allowedLocations can be passed to a policy artefact, letting the assigner specify which Azure regions are permitted for each subscription without editing the blueprint definition itself.

A blueprint assignment applies a published blueprint version to a specific subscription. During assignment, you provide values for any blueprint parameters, select the system-assigned or user-assigned managed identity that the blueprint uses to deploy artefacts (it needs sufficient RBAC permissions), and choose whether blueprint artefacts should be locked after deployment to prevent modification by subscription users.

Blueprint assignments can lock deployed artefacts to prevent subscribers from modifying or deleting them. Three lock modes exist: None (no locks), AllResourcesReadOnly (ReadOnly lock on all deployed resources), and AllResourcesDoNotDelete (CanNotDelete lock on all deployed resources). Blueprint locks are special — they cannot be removed even by subscription Owners while the blueprint assignment is in place, providing stronger protection than standard resource locks.

Azure provides regulatory compliance blueprints in the Azure Blueprints sample gallery for frameworks including ISO 27001, NIST SP 800-53, PCI DSS, DoD IL4/IL5, FedRAMP, HIPAA/HITRUST, and UK OFFICIAL. These sample blueprints package the policies, role assignments, and infrastructure configurations needed to evidence compliance with each framework. Organisations use them as starting points, customising and adding artefacts specific to their environment.

ARM templates and Blueprints serve different purposes. An ARM template deploys infrastructure in a single resource group or subscription with no ongoing connection to the deployed resources. A Blueprint assignment maintains a living link between the blueprint definition and the deployed environment: you can track the deployment status, upgrade to a new version, and protect deployed artefacts with blueprint locks that survive even Owner-level RBAC. Blueprints extend ARM templates with governance-specific capabilities.

Microsoft's modern Azure Landing Zone accelerator (part of the Cloud Adoption Framework) uses a combination of ARM templates, Bicep, Terraform, and Azure Policy rather than Blueprints. While Blueprints remain available, Microsoft is investing more in policy-driven approaches and IaC for large-scale environments. For complex enterprise deployments, the CAF Landing Zone approach is now preferred; Blueprints remain suitable for smaller-scale, self-contained environment templates.

In the Azure Blueprints blade, each blueprint assignment shows its deployment status (Succeeded, Failed, Locking) and the compliance status of each artefact. If an artefact deployment fails, you can see the ARM deployment error and retry the assignment. The policy artefacts within a blueprint report their compliance via the standard Azure Policy compliance dashboard, so you have unified visibility into both deployment success and ongoing resource compliance.

To decommission a blueprint-managed environment, you first delete the blueprint assignment. This removes the blueprint locks from all deployed artefacts and severs the link between the blueprint definition and the deployed resources — but it does not delete the deployed resources themselves. You then clean up the ARM resources separately according to your change management process. Deleting the blueprint definition requires deleting all assignments first.

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

In this lesson you learned: Azure Blueprints packages policy assignments, role assignments, ARM templates, and resource groups into a versioned, reusable governance object, blueprint locks protect deployed artefacts from modification even by subscription Owners, and regulatory compliance blueprints in the sample gallery accelerate achieving frameworks like ISO 27001 and PCI DSS. You have now completed the Azure Governance course — next up is Azure Resource Manager and Infrastructure as Code.