Apply Specific NSG - Public Facing.json

{
    "properties": {
      "displayName": "Apply specific NSG - Public Facing",
      "policyType": "Custom",
      "mode": "All",
      "description": "Restricts the usage of NSGs to only those specific within the NSGid parameter",
      "parameters": {
        "nsgId": {
          "type": "Array",
          "metadata": {
            "displayName": "NSG Id",
            "description": "Resource Ids of the allowed Network Security Groups"
          },
          "allowedValues": [
            "/subscriptions/829ac3c2/resourceGroups/ONLINE/providers/Microsoft.Network/networkSecurityGroups/ONLINE-NEU-NSG-001",
            "/subscriptions/829ac3c2/resourceGroups/ONLINE/providers/Microsoft.Network/networkSecurityGroups/ONLINE-WEU-NSG-001"
          ]
        }
      },
      "policyRule": {
        "if": {
          "anyOf": [
            {
              "allOf": [
                {
                  "field": "type",
                  "equals": "Microsoft.Network/virtualNetworks"
                },
                {
                  "field": "Microsoft.Network/virtualNetworks/subnets[*].networkSecurityGroup.id",
                  "notin": "[parameters('nsgId')]"
                }
              ]
            },
            {
              "allOf": [
                {
                  "field": "type",
                  "equals": "Microsoft.Network/virtualNetworks/subnets"
                },
                {
                  "field": "Microsoft.Network/virtualNetworks/subnets/networkSecurityGroup.id",
                  "notin": "[parameters('nsgId')]"
                }
              ]
            }
          ]
        },
        "then": {
          "effect": "deny"
        }
      }
    }
  }