Azure service for defining and enforcing rules on cloud resources. Covers policy definitions and initiatives, effects such as deny, audit and deployIfNotExists, compliance reporting and remediation, and assignment across management groups and subscriptions.