1. No—to assign permissions to users, you need to use role-based access control.
2. Yes—you can use the Azure policy to check whether all of the virtual machines inside your Azure subscription use managed disks.
3. No—custom policies are created in JSON.