Security compliance

Overview

Security compliance is a document type in Azure Documenter that provides a detailed status report on policy assignments across your subscriptions and resources.

Business value

Get a consolidated view of policy adherence across subscriptions without switching between the Azure portal and multiple compliance dashboards
Filter the report by specific policy states to focus on non-compliant or conflicting resources ahead of audits or governance reviews
Share a structured, exportable compliance snapshot with security and audit teams on demand

Prerequisites

Required permissions

Role	Permission level	Access
Account owner, Owner, Contributor	-	Full access to the Documentation section
Custom role	Read	View documents generated under Documentation
Custom role	Manage	View, generate, and manage documents under Documentation

How it works

The Security compliance document reports on the status of Azure Policy assignments across your subscriptions and resources.

Document structure

The document is organized per subscription. For each subscription, the report includes:

Assignments: a table listing all policy assignments with counts for Compliant, Non Compliant, Exempt, and Conflict resources per assignment
Per initiative: for each initiative assignment, a list of the policies it contains or "No data available" if the initiative has no policy details
Policy groups: policies not grouped under an initiative appear under "Not grouped policies" with their compliance state
Per policy: a detailed resource-level table listing every resource evaluated under the policy

The per-policy resource table columns are:

Column	Description
Resource	The name of the Azure resource
Resource type	The Azure resource type (e.g., Virtual Machines, SQL Databases, App Services)
Compliance state	Compliant or Non compliant

If a subscription has no policy assignments configured, the document shows No initiatives available for that subscription.

Policy states:

All: Includes Not Compliant, Compliant, Conflict, and Exempt states.
Compliant: Includes policies with the state Compliant.
Non compliant: Includes policies with the state Non-Compliant.
Conflict: Includes policies with the state Conflict.
Exempt: Includes policies with the state Exempt.

Learn more about how compliance and policy states work in the Azure Policy documentation.

Steps

Use the following steps to generate a Security compliance document. Navigate to Azure Documenter to get started.

Click New configuration. The Configure your document wizard opens.
In Step 1: Basics, enter a configuration name. Under Choose document type, select Security compliance. Choose the Policy states to include: All, Compliant, Non compliant, Conflict, or Exempt. Click Next.
In Step 2: Service principal, select the service principal and configure the subscription scope. Click Next.
Complete Steps 3–6 (Branding, Publish settings, Schedule, Notifications) as required. Click Next after each step.
In Step 7: Review, confirm your configuration and click Finish.

Once generation is complete, a URL is created for the document, and you can download it using the Download link.

Example scenario

A cloud governance team needs to confirm whether all production subscriptions comply with the organization's tagging and encryption policies before a quarterly audit. They generate a Security compliance document scoped to those subscriptions, filtering for Non compliant and Conflict states, and share the generated URL with the audit team.

Troubleshooting

Security compliance document returns no data for a subscription
Cause: no policy assignments are configured for the selected subscriptions in Azure Policy.
Fix: verify that policy assignments exist for the subscriptions and that the service principal has permissions to read compliance data.
Document generation fails or returns incomplete data
Cause: the service principal lacks the required permissions to read Azure Policy compliance data for the selected subscriptions.
Fix: verify the service principal has at least Reader access on all selected subscriptions, then regenerate.
Per-policy resource table is empty for a compliant policy
Cause: the selected Policy states filter excludes Compliant resources from the output.
Fix: set Policy states to All in Step 1: Basics to include resources across all compliance states.

FAQs

What subscriptions can I include in a Security compliance document?
You can choose any of the subscriptions available in your Azure Documenter document configuration when setting up the document.
What do the policy states in the document mean?
Policies can appear as All, Compliant, Non compliant, Conflict, or Exempt. See the policy states callout above for what each state includes.
Can I generate a Security compliance document without creating a new configuration?
Yes. Use the Context menu ( ⋮ ) next to any existing document configuration in the tree view.