2.3. Implement Governance to Enforce Security and Regulatory Compliance

💡 First Principle: Individually-correct configurations drift out of compliance the moment nobody's watching — governance is the set of controls that keep an entire environment, not just one resource, matching the security standard you intended, and that catch drift automatically instead of relying on someone remembering to check.

Without governance, every other control in this guide is only as good as the last person who touched the resource. A perfectly configured storage account today can be reconfigured insecurely tomorrow by someone with valid — but overly broad — permissions, and nothing will notice unless governance tooling is watching.

Mental model: RBAC answers "who is allowed to act," Azure Policy answers "what configurations are resources allowed to have regardless of who acts," and Defender for Cloud's compliance tooling answers "how well does the whole environment currently match a named standard." All three are necessary because none of them alone covers what the other two catch.

⚠️ Common Misconception: Azure Policy and Azure RBAC are not solving the same problem. A user with full Contributor rights (RBAC) can still be blocked by Policy from creating a storage account without encryption enabled — Policy enforces configuration standards independent of who has permission to act.