You have an Azure subscription that has Microsoft Defender for Cloud enabled. You need to enforce ISO 27001:2013 standards for new resources deployed to the subscription. The solution must ensure that

Azure Blueprints orchestrates the deployment of policies and other artifacts, but compliance detection and enforcement are performed by the underlying Azure Policy; Blueprints itself does not detect noncompliant resources and is also being deprecated in favor of direct Policy assignment.

The regulatory compliance dashboard in Defender for Cloud displays compliance results but depends on Azure Policy assignments to perform the actual evaluation; it is a reporting surface, not an enforcement or detection mechanism on its own.

Azure Policy allows assignment of the built-in ISO 27001:2013 initiative, which evaluates resource configurations against the standard's controls in real time. When new resources are deployed, Policy automatically assesses them and marks noncompliant resources, satisfying the requirement for automatic detection. Policy effects such as 'audit' and 'deny' can both detect and prevent noncompliant configurations.

Azure RBAC manages user permissions and access control but does not evaluate or enforce resource configuration compliance against standards like ISO 27001:2013.