Which mechanism can explicitly block an action even when an allow assignment exists?
- A A deny assignment (for example created by Azure Blueprints or a managed application) (correct answer)
- B A Reader role
- C A resource lock
- D A tag
Shortcut: Deny assignments take precedence over allow assignments. They are created by the platform, not directly by users, and are how managed applications protect their resources.