{
    "if": {
        "allOf": [
            {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions/resourceGroups"
            },
            {
            "field": "[concat('tags[', parameters('tagName'), ']')]",
            "equals": "[parameters('tagValue')]"
            }
        ]
    },
    "then": {
        "effect": "auditIfNotExists",
        "details": {
            "type": "Microsoft.Authorization/locks",
            "existenceCondition": {
                "field": "Microsoft.Authorization/locks/level",
                "equals": "CanNotDelete"
            }
        }
    }
}