What happens if you set an Azure policy specifying that virtual networks are not an allowed resource type in a resource group?