https://jeffbrown.tech/azure-policy-resource-lock/