Engineer Uses Azure Policy and Custom RBAC to Block Unauthorized Cloud VM Deployments

A DevSecOps engineer has detailed how they implemented automated guardrails on Microsoft Azure to prevent unexpected cloud cost spikes caused by human error. Using Azure Policy and custom RBAC least-privilege roles, they configured the Azure Resource Manager API to automatically intercept and deny any virtual machine deployment requests that fall outside a pre-approved list of low-cost B-Series SKUs. The policy was deployed via Azure CLI to a sandbox resource group in the Southeast Asia region, blocking higher-cost SKU families such as D-Series nodes at the point of request. To further tighten access controls, a custom VM Restart Operator role was created, restricting user permissions strictly to visibility and reboot actions while sealing off write, configuration, and deletion capabilities. The approach shifts cloud cost governance from reactive cleanup and policy handbooks to proactive, programmatic enforcement at the infrastructure level.