deny-security-controls

Type: decision

Decision

Azure Policy enforces hard denies on public network access, local authentication, minimum TLS, and cross-tenant replication, on every resource type that supports them.

Why

Without enforcement, misconfiguration is invisible.

Links

• azure-policy-naming-convention — All deploy as Deny-prefixed assignments.
• self-service-policy-exemptions — Hard denial only works if teams can unblock themselves.
• azure-policy-custom-definition — Custom definitions close gaps where built-ins only offer Audit.
• landing-zone-allowed-public-ip — A platform-provided public IP exists for teams that need human access to the data plane.
• landing-zone-getting-started — Getting-started modules must comply with active deny policies

← Back to all decisions