How to deny permission to create resources in Azure except some users - azure

Question

Is there any in built role to deny permission to create resources in az subscription except some users. I.
I have used 'not allowed resources types' policy but it applies to whole subscription.

Answer 1

I Tried to reproduce the same in my environment to deny the resource creation in Azure:
Thanks to Tiny Wang for suggesting the same.
Assign Reader role to Users or Group for restricting resource creation in Azure, like below.
Azure Portal > Subscription > Select your subscription > Access control (IAM) > Add > Add role assignment.
Reader role assigned.
When I tried to create Azure VM within Subscription, I got an authorization error with the same user.
Note: if you create an Azure policy to deny the resource creation, the policy will apply to the scope level, not to users.
Ex: Subscription, Resource Groups
I have created a policy and assigned it to the resource group scope to deny resource creation within a resource group.
When I tried to create any resource, I got a policy restriction error.
Azure Policy rule:
{
"mode": "All",
"policyRule": {
"if": {
"field": "type",
"in": "[parameters('listOfResourcesTypesNotAllowed')]"
},
"then": {
"effect": "Deny"
}
},
"parameters": {
"listOfResourcesTypesNotAllowed": {
"type": "Array",
"metadata": {
"displayName": "Not Allowed Resources creation",
"description": "The list of resources type that cannot be deployed.",
"strongType": "resourceTypes"
}
}
}
}