{
   "properties": {
      "displayName": "Allowed locations",
      "policyType": "BuiltIn",
      "mode": "Indexed",
      "description": "This policy enables you to restrict the locations your organization can specify when deploying resources. Use to enforce your geo-compliance requirements. Excludes resource groups, Microsoft.AzureActiveDirectory/b2cDirectories, and resources that use the 'global' region.",
      "metadata": {
         "version": "1.0.0",
         "category": "General"
      },
      "parameters": {
         "listOfAllowedLocations": {
            "type": "Array",
            "metadata": {
               "description": "The list of locations that can be specified when deploying resources.",
               "strongType": "location",
               "displayName": "Allowed locations"
            }
         }
      },
      "policyRule": {
         "if": {
            "allOf": [
               {
                  "field": "location",
                  "notIn": "[parameters('listOfAllowedLocations')]"
               },
               {
                  "field": "location",
                  "notEquals": "global"
               },
               {
                  "field": "type",
                  "notEquals": "Microsoft.AzureActiveDirectory/b2cDirectories"
               }
            ]
         },
         "then": {
            "effect": "deny"
         }
      }
   },
   "id": "/providers/Microsoft.Authorization/policyDefinitions/e56962a6-4747-49cd-b67b-bf8b01975c4c",
   "name": "e56962a6-4747-49cd-b67b-bf8b01975c4c"
}