A harbor-radar shop adds Microsoft.Compute/* to Actions and lists several delete operations under NotActions. A reviewer claims that creates a subscription-wide deny. What is the accurate statement about NotActions?
Select an answer to reveal the explanation.
Short Explanation
NotActions is a sticky note on one role card saying “except these,” not a courthouse injunction against the whole subscription. It trims that role’s own Actions wildcard—it is not a deny assignment and not Azure Policy.
Full Explanation
NotActions and NotDataActions exclude operations from the allowed set defined in the same custom role. They do not create deny assignments and they do not behave like Azure Policy Deny effects. Effective access still unions other role assignments the principal holds.