You create an Azure Policy scoped to a resource group that sets Virtual Machines as not allowed resource types. Later you move a virtual machine from other resource group to a resource group covered by Azure Policy. What happens?