Azure Policy: Deny Service Endpoints on subnets

Deny-Service-Endpoints.json

{
  "name": "Deny Service Endpoints on subnets",
  "description": "This Policy will deny the enablement of Service Endpoints on subnets. This will also prevent PaaS resources such as Azure Storage from being able to add this subnet to their firewall allowed list.",
  "mode": "All",
  "policyRule": {
    "if": {
      "anyOf": [
        {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Network/virtualNetworks"
            },
            {
              "count": {
                "field": "Microsoft.Network/virtualNetworks/subnets[*]",
                "where": {
                  "not": {
                    "field": "Microsoft.Network/virtualNetworks/subnets[*].serviceEndpoints[*].service",
                    "notLike": "*"
                  }
                }
              },
              "greater": 0
            }
          ]
        },
        {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Network/virtualNetworks/subnets"
            },
            {
              "not": {
                "field": "Microsoft.Network/virtualNetworks/subnets/serviceEndpoints[*].service",
                "notLike": "*"
              }
            }
          ]
        }
      ]
    },
    "then": { "effect": "[parameters('effect')]" }
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "Enable or disable the execution of the policy"
      },
      "allowedValues": ["Deny", "Disabled"],
      "defaultValue": "Deny"
    }
  }
}