Audit, configuration & compliance
AWS Config vs Azure Policy / Azure Resource Graph (inventory and change analysis)
AWS Config maps to a combination of Azure Policy (compliance evaluation and remediation) and Azure Resource Graph (inventory and change history).
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | AWS Config | Azure Policy Azure Resource Graph (inventory and change analysis) |
| Lifecycle | Generally available | Generally available Generally available |
| What it is | Records resource configuration history and relationships, and evaluates resources against managed or custom rules and conformance packs, with remediation. | Evaluates and enforces rules on Azure resources (deny, audit, modify, deployIfNotExists), grouped into initiatives and assigned at any scope, with compliance reporting and remediation. KQL queries across subscriptions for resource inventory, policy compliance, and resource property changes (change history). |
| Pricing model | Per configuration item recorded, plus per rule evaluation and conformance pack evaluation. | Azure Policy and Resource Graph are free for Azure resources. |
| Docs | AWS Config docs | Azure Policy docs Azure Resource Graph (inventory and change analysis) docs |
| Pricing page | AWS Config pricing | Azure Policy pricing Azure Resource Graph (inventory and change analysis) pricing |
| Exams | SOA-C03 SCS-C03 | AZ-104 AZ-305 |
Key differences
- Recording. Config records configuration items and relationships continuously for the resource types you select, with history you can keep for years. Resource Graph change analysis covers recent property changes, so long-term history needs exports.
- Rules. Config rules (managed or custom Lambda or Guard) and conformance packs map to Azure Policy definitions and initiatives. Azure Policy can also block non-compliant deployments up front.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- AWS
- Per configuration item recorded, plus per rule evaluation and conformance pack evaluation. AWS Config pricing →
- Azure
- Azure Policy and Resource Graph are free for Azure resources. Azure Policy pricing → Azure Resource Graph (inventory and change analysis) pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified CloudOps Engineer – Associate SOA-C03 | AWS | Associate | current Replaces AWS Certified SysOps Administrator – Associate (SOA-C02), whose last exam day was Sep 29, 2025. Simplified Chinese and Korean versions retire after Nov 19, 2026. |
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Solutions Architect Expert AZ-305 | Azure | Expert | current English version updated Apr 17, 2026. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of AWS Config?
AWS Config maps to a combination of Azure Policy (compliance evaluation and remediation) and Azure Resource Graph (inventory and change history).
How does pricing compare between AWS Config and Azure Policy and Azure Resource Graph (inventory and change analysis)?
AWS: Per configuration item recorded, plus per rule evaluation and conformance pack evaluation. Azure: Azure Policy and Resource Graph are free for Azure resources. Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified CloudOps Engineer – Associate (SOA-C03); AWS Certified Security – Specialty (SCS-C03); Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Solutions Architect Expert (AZ-305).