You need to write a custom Azure Policy that denies any Azure OpenAI resource without a private endpoint. Simple enough requirement. An hour later, you’re still hunting for the right resource provider alias, your JSON nesting is wrong, and the policy ARM rejects on every test run. Azure Policy …