azure-policy-hard-deny

Type: decision

Decision

Security controls are enforced through hard deny policies — misconfiguration is blocked, not just reported.

Why

Without enforcement, misconfiguration is invisible.

Violations

• Azure resource with public network access enabled.
• Resource with local authentication enabled.
• Key Vault configured with Access Policies instead of RBAC.
• Resource with minimum TLS version below 1.2.
• Storage account with cross-tenant object replication enabled.

Links

• azure-policy-naming-convention — All deploy as Deny-prefixed assignments.
• self-service-policy-exemptions — Hard denial only works if teams can unblock themselves.
• azure-policy-custom-definition — Custom definitions close gaps where built-ins only offer Audit.
• landing-zone-allowed-public-ip — A platform-provided public IP exists for teams that need human access to the data plane.
• landing-zone-getting-started — Getting-started modules must comply with active deny policies

← Back to knowledge graph