Merge pull request #272552 from davidsmatlak/ds-move-policy-includes-20240417

Moves and updates Azure Policy include files

Author: v-ccolin

articles/azure-resource-manager/management/azure-subscription-service-limits.md

@@ -229,7 +229,7 @@ For Azure Monitor limits, see [Azure Monitor service limits](../../azure-monitor
 
 ## Azure Policy limits
 
-[!INCLUDE [policy-limits](../../../includes/azure-policy-limits.md)]
+[!INCLUDE [azure-policy-limits](../../governance/includes/policy/azure-policy-limits.md)]
 
 ## Azure Quantum limits
 

articles/governance/includes/policy/azure-policy-deny-action.md

@@ -0,0 +1,18 @@
+---
+ms.topic: include
+ms.service: azure-policy
+ms.date: 04/17/2024
+ms.author: kenieva
+author: kenieva
+---
+
+This table describes if a resource is protected from deletion given the resource applicable to the assigned `denyAction` policy and the targeted scope of the `DELETE` call. In the context of this table, an indexed resource is one that supports tags and locations and a non-indexed resource is one that doesn't support tags or locations. For more information on indexed and non-indexed resources, go to [definition mode](../../policy/concepts/definition-structure-basics.md#mode). Child resources are resources that exist only within the context of another resource. For example, a virtual machines extension resource is a child of the virtual machine, which is the parent resource.
+
+| Entity being deleted| Entity applicable to policy conditions | Action taken |
+|---|---|---|
+| Resource | Resource | Protected |
+| Subscription | Resource | Deleted |
+| Resource group | Indexed resource| Depends on `cascadeBehaviors` |
+| Resource group | Non indexed resource| Deleted |
+| Child resource | Parent resource | Parent is protected; child is deleted |
+| Parent resource | Child resource | Deleted |

includes/azure-policy-limits.md renamed to articles/governance/includes/policy/azure-policy-limits.md

@@ -1,14 +1,12 @@
 ---
-title: "include file"
-description: "include file"
-author: davidsmatlak
+ms.topic: include
 ms.service: azure-policy
-ms.topic: "include"
-ms.date: 09/30/2020
+ms.date: 04/17/2024
 ms.author: davidsmatlak
+author: davidsmatlak
 ---
 
-There's a maximum count for each object type for Azure Policy. For definitions, an entry of _Scope_ means the [management group](../articles/governance/management-groups/overview.md) or subscription. For assignments and exemptions, an entry of _Scope_ means the [management group](../articles/governance/management-groups/overview.md), subscription, resource group, or individual resource.
+There's a maximum count for each object type for Azure Policy. For definitions, an entry of _Scope_ means the [management group](../../management-groups/overview.md) or subscription. For assignments and exemptions, an entry of _Scope_ means the management group, subscription, resource group, or individual resource.
 
 | Where | What | Maximum count |
 |---|---|---|
@@ -25,4 +23,4 @@ There's a maximum count for each object type for Azure Policy. For definitions,
 | Remediation task | Resources | 50,000 |
 | Policy definition, initiative, or assignment request body | Bytes | 1,048,576 |
 
-Policy rules have additional limits to the number of conditions and their complexity. See [Policy rule limits](../articles/governance/policy/concepts/definition-structure.md#policy-rule-limits) for more details.
+Policy rules have more limits to the number of conditions and their complexity. For more information, go to [Policy rule limits](../../policy/concepts/definition-structure-policy-rule.md#policy-rule-limits) for more details.

articles/governance/policy/concepts/effect-deny-action.md

@@ -1,7 +1,7 @@
 ---
 title: Azure Policy definitions denyAction effect
 description: Azure Policy definitions denyAction effect determines how compliance is managed and reported.
-ms.date: 04/08/2024
+ms.date: 04/17/2024
 ms.topic: conceptual
 ---
 
@@ -27,7 +27,7 @@ Policy evaluates resources that support location and tags against `denyAction` p
 
 Cascade deletion occurs when deleting of a parent resource is implicitly deletes all its child and extension resources. Policy doesn't block removal of child and extension resources when a delete action targets the parent resources. For example, `Microsoft.Insights/diagnosticSettings` is an extension resource of `Microsoft.Storage/storageaccounts`. If a `denyAction` policy targets `Microsoft.Insights/diagnosticSettings`, a delete call to the diagnostic setting (child) fails, but a delete to the storage account (parent) implicitly deletes the diagnostic setting (extension).
 
-[!INCLUDE [policy-denyAction](../../../../includes/azure-policy-deny-action.md)]
+[!INCLUDE [azure-policy-deny-action](../../includes/policy/azure-policy-deny-action.md)]
 
 ## DenyAction properties
 

articles/governance/policy/overview.md

@@ -1,7 +1,7 @@
 ---
 title: Overview of Azure Policy
 description: Azure Policy is a service in Azure, that you use to create, assign and, manage policy definitions in your Azure environment.
-ms.date: 06/15/2023
+ms.date: 04/17/2024
 ms.topic: overview
 ---
 
@@ -327,7 +327,7 @@ available. For information on the assignment structure, see
 
 ## Maximum count of Azure Policy objects
 
-[!INCLUDE [policy-limits](../../../includes/azure-policy-limits.md)]
+[!INCLUDE [policy-limits](../includes/policy/azure-policy-limits.md)]
 
 ## Next steps