azure-policy-effect-declaration

Type: regulative

Decision

A guardrail must declare exactly one effect: deny, config, or allowed.

Why

Without a declared effect, a guardrail does not state whether it blocks, configures, or permits.

Violations

• Guardrail declared without an effect.
• Guardrail declaring more than one effect.
• Guardrail effect outside deny, config, or allowed.

Anchor

no-unapproved-resources

Implements

• guardrail

Files

• platform-management/policy/bicep/oases.bicep
• platform-management/policy/bicep/modules/assignment.bicep

← Back to knowledge graph