Deployment stacks give you Complete mode without the blast radius, and deny settings are the reason to adopt them. Then I moved a protected resource to another resource group and watched the protection stay behind.