Azure indexed policy not being applied to resource group

Question

I'm writing some azure policies that force certain tags to be in place, as well as inheriting tags from a subscription to a resource group. However, when these policies are set to indexed mode (as recommended by azure) they aren't applied when creating a resource group, only on resources themselves. When the mode is set to All however, the policies work on the resource group. Is there something I'm doing wrong? I don't want to set the mode to All because that could cause conflicts with resources that don't support tagging right?

Answer 1

I solved it myself by setting the mode to All, but only denying an action if the field is set to resource group.

{
  "properties": {
    "displayName": "Require a tag on resources",
    "policyType": "Custom",
    "mode": "All",
    "description": "Enforces existence of a the project tag",
    "metadata": {
      "version": "1.0.1",
      "category": "Tags"
    },
    "parameters": {},
    "policyRule": {
      "if": {
        "allOf": [ {
            "field": "[concat('tags[', 'project', ']')]",
            "exists": "false"
          },
          {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions/resourceGroups"
          }
        ]
      },
      "then": {
        "effect": "deny"
      }
    }
  }
}