{
   "if": {
      "allOf": [
         {
            "field": "type",
            "equals": "Microsoft.Resources/subscriptions/resourceGroups"
         },
         {
            "not": {
               "field": "[concat('tags[',parameters('tagName'), ']')]",
               "equals": "[parameters('tagValue')]"
            }
         }
      ]
   },
   "then": {
      "effect": "deny"
   }
}