How to exclude a group of users in an azure policy from deny action

Question

current situation: there is a zure policy with deny action that prohibits the deletion of resource groups and resources.

requirement: create a user group in azure in which every member of that group is excluded from the azure policy deny action

Answer 1

@Omer Jesus Gonzalez Vizcaino Groups cannot be sent as a parameter in Azure Policy. However, you can use the "If" function in the policy definition to conditionally apply the policy based on the list of users.

Here is snippet of policy code.

{ 
	"not": 
		{ 
			"field": "Microsoft.Authorization/roleAssignments[*].principalId", 
			"in": "[parameters('excludedUserEmails')]" 
		}
 }