Multi-account governance & guardrails
Service control policies and resource control policies vs Azure Policy
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations.
Azure RBAC deny assignments cover only limited scenarios.
Side-by-side comparison
| Aspect | Amazon Web Services | Microsoft Azure |
|---|---|---|
| Service | Service control policies and resource control policies | Azure Policy |
| Lifecycle | Generally available | Generally available |
| What it is | Organization guardrails. SCPs cap the maximum permissions of principals in member accounts, and RCPs cap the permissions that can be granted on supported resources. | Evaluates and enforces rules on Azure resources (deny, audit, modify, deployIfNotExists), grouped into initiatives and assigned at any scope, with compliance reporting and remediation. |
| Pricing model | Free. | Free for Azure resources (some guest configuration and Arc scenarios are billed). |
| Docs | Service control policies and resource control policies docs | Azure Policy docs |
| Pricing page | Service control policies and resource control policies pricing | Azure Policy pricing |
| Exams | SCS-C03 SAP-C02 Retiring | AZ-104 AZ-305 SC-500 |
Key differences
- What's controlled. SCPs limit which API actions principals in member accounts can call, and RCPs limit what can be granted on resources (for example, blocking external access to S3). Azure Policy evaluates resource properties at deployment and continuously, so it can deny a public IP or require tags, but it doesn't restrict which management actions an identity may call in general.
- Remediation. Azure Policy can modify resources or deploy missing settings (deployIfNotExists), with compliance reports. SCPs only allow or deny, and AWS uses Config rules or Control Tower proactive controls for configuration checks.
Pricing summary
Pricing models only. No prices are quoted because they change by region and over time.
- Azure
- Free for Azure resources (some guest configuration and Arc scenarios are billed). Azure Policy pricing →
Certification exam mapping
| Exam | Provider | Level | Status |
|---|---|---|---|
| AWS Certified Security – Specialty SCS-C03 | AWS | Specialty | current The current code (SCS-C03) is taken from the exam-prep link on the official certification page. Simplified Chinese, Spanish (Latin America), and Portuguese (Brazil) versions retire after Dec 31, 2026. |
| AWS Certified Solutions Architect – Professional SAP-C02 | AWS | Professional | retiring Being updated to SAP-C03. Registration for SAP-C03 opens Oct 27, 2026. Last day to take SAP-C02 is Nov 16, 2026. |
| Microsoft Certified – Azure Administrator Associate AZ-104 | Azure | Associate | current |
| Microsoft Certified – Azure Solutions Architect Expert AZ-305 | Azure | Expert | current English version updated Apr 17, 2026. |
| Microsoft Certified – Cloud and AI Security Engineer Associate SC-500 | Azure | Associate | current New certification. A practice assessment isn't available yet, which the page says usually means the exam recently left (or is in) beta. |
Relevance is based on each exam's published scope, not a line-by-line objective match. Check the official study guide.
FAQ
What is the Azure equivalent of Service control policies and resource control policies?
Service control policies (and resource control policies) map most closely to Azure Policy assigned at management groups, which can deny, audit, or fix resource configurations. Azure RBAC deny assignments cover only limited scenarios.
How does pricing compare between Service control policies and resource control policies and Azure Policy?
AWS: Free. Azure: Free for Azure resources (some guest configuration and Arc scenarios are billed). Check the official pricing pages for current rates.
Which certification exams cover this topic?
AWS Certified Security – Specialty (SCS-C03); AWS Certified Solutions Architect – Professional (SAP-C02) [retiring]; Microsoft Certified – Azure Administrator Associate (AZ-104); Microsoft Certified – Azure Solutions Architect Expert (AZ-305); Microsoft Certified – Cloud and AI Security Engineer Associate (SC-500).