Category Governance

An exclusion silences a rule. An exemption records that you decided to. The difference is the only durable evidence most estates keep of the risk they have knowingly accepted.

Confirm the alias before designing anything, handle the absent-property trap on purpose, and prove one custom definition against a resource built to fail and one built to pass.

A custom definition is a maintenance commitment with no end date. The test for taking one on, the alias constraint that kills most ideas before they start, and the cases where the answer is not a policy at all.

Fork one baseline control that reports but cannot enforce, with the necessity gate in front, provenance recorded in the object, and both versions running side by side until the copy proves itself.

You cannot edit a built-in. You can only duplicate it, and from that moment the maintenance is yours. Here is when that trade is worth making and what you owe the copy afterwards.

A remediating assignment built end to end: the roles read from the definition rather than guessed, an identity granted deliberately, and a remediation task with its thresholds set on purpose.

deployIfNotExists and modify are standing write authority held by a managed identity. The caller evaluates, the identity deploys, and the gap between them is where least privilege is won or lost.

Allowed resource types, working delete protection with its cascade behaviour set deliberately, and resource selectors that aim a rule at part of the estate first. The delta beyond what the Landing Zones build sheet already gave you.