PermissionsThe Enforce Approved Extensions Are Installed on Azure Compute Virtual Machines policy pack requires 2 permissions:microsoft.compute/virtualmachines/deallocate/actionmicrosoft.compute/virtualmachines/delete