azure-policy-hard-deny

Type: decision

Decision

Security controls are enforced through deny policies.

Why

Without deny policies, resources deploy in a non-compliant state, deviating from the security baseline.

Violations

• Azure resource with public network access enabled.
• Resource with local authentication enabled.
• Key Vault configured with Access Policies instead of RBAC.
• Resource with minimum TLS version below 1.2.
• Storage account with cross-tenant object replication enabled.

Links

• azure-policy-naming-convention — Without the naming convention's deny prefix rule, deny policy assignments have no consistent identity.
• azure-policy-custom-definition — Custom definitions provide the Deny effect where built-in policies don't — without them, deny coverage has gaps.

← Back to knowledge graph