Every resource type is denied until the platform has validated its security controls, telemetry, and integration pattern.
Why
Without an approved list, the platform cannot guarantee that every resource follows its configuration rules.
Violations
Extending the allowed resources file without reviewing deny policies first.
Links
azure-policy-naming-convention — The allowed prefix is defined by the naming convention — the assignment won't be discoverable without it.
landing-zone-diagnostic-settings — A diagnostic settings policy must exist for the type — approval without one leaves telemetry uncovered.
job-function-scoped-roles — Some types expose non-standard RBAC actions beyond generic read — approval is incomplete without checking job-function role coverage.
azure-policy-hard-deny — A type is approvable only once deny policies cover its misconfigurations — the allowlist assumes that coverage.
azure-native-services-only — ARM-reachability is the prerequisite for allowlisting — types outside ARM are ineligible.