azure-policy-allowed-resources

Type: decision

Decision

Every resource is denied by default. It appears on the allowed list only after the platform has approved it.

Why

Without an approved list, the platform cannot guarantee that every resource follows its configuration rules.

Links

• azure-policy-naming-convention — Must use an Allowed-prefixed assignment for resource-type compliance.
• landing-zone-diagnostic-settings — Every approved type must have a diagnostic settings definition.
• job-function-scoped-roles — New resource type triggers review of whether function-scoped roles need new actions.
• self-service-policy-exemptions — Hard deny becomes a bottleneck without a self-service exemption path.
• azure-policy-custom-definition — New resource type with no built-in Deny policy requires a custom definition before security coverage is complete.
• azure-native-services-only — ARM-reachability is the prerequisite for allowlisting — types outside ARM are ineligible.
• self-service-policy-exemptions-defender-for-cloud — Whitelisting triggers a Defender check — paid-SKU recommendations or remediation that requires cost go on the exemption list.
• landing-zone-getting-started — Whitelisting is incomplete until the template has a thin example module

← Back to all decisions