I’m aware that Azure RBAC is an additive model, so your effective permissions are the sum of your role assignments. However, I’m not sure/unable to find a definitive answer if the same applies to Azure Policy?
Assuming, I have the following structure:
If I apply a policy definition “allowed location” to enforce that only “West Europe” can be used as a region for resource deployment at the Tenant Root Group level, that policy would be applied to subscriptions under both MG-A and MG-B. What, If I then assign the “Storage accounts should use customer-managed key for encryption” policy definition at the MG-B level next. Would the outcome be:
MG-A (only “allowed location” enforced) on Sub 1A and Sub 2A. MG-B (“allowed location” + “Storage accounts should use customer-managed key for encryption”) on Sub 1B
Are my assumptions correct?