Azure Policy, exclude resource type

Question

I am currently using this policy to successfully disable public access for Azure Storage accounts. However, when provisioning Function Apps or App Services, the same policy is preventing their creation. I am attempting to make adjustments to the policy to exclude Function Apps and App Services, allowing them to be created without being blocked by this Policy.

Here is the JSON I have tried, but it is not working as expected. It is still blocking the creation of Function Apps and App Services, indicating that Azure Storage account public access should be restricted.

Tried to use the this policy to exempt the function and app services but still being blocked by the Policy.

Kindly suggest what adjustments to make to allow Azure app services to deploy without being blocked by the Storage accounts should restrict network access policy, or is there any better approach to deal with it. ?

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "notequals": "Microsoft.Web/sites"
        },
        {
          "anyOf": [
            {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            {
              "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
              "notEquals": "Deny"
            }
          ]
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]"
    }
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "The effect determines what happens when the policy rule is evaluated to match"
      },
      "allowedValues": [
        "Audit",
        "Deny",
        "Disabled"
      ],
      "defaultValue": "Audit"
    }
  }
}

Answer 1

it is working applying this policy

{
  "mode": "Indexed",
  "policyRule": {
    "if": {
      "anyOf": [
        {
          "not": {
            "field": "type",
            "equals": "Microsoft.Web/serverfarms"
          }
        },
        {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            {
              "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
              "equals": "Allow"
            }
          ]
        },
        {
          "not": {
            "anyOf": [
              {
                "field": "type",
                "equals": "Microsoft.Web/sites"
              },
              {
                "field": "type",
                "equals": "Microsoft.Web/serverfarms"
              }
            ]
          }
        }
      ],
      "allOf": [
        {
          "not": {
            "field": "type",
            "equals": "Microsoft.Web/serverfarms"
          }
        },
        {
          "allOf": [
            {
              "field": "type",
              "equals": "Microsoft.Storage/storageAccounts"
            },
            {
              "field": "Microsoft.Storage/storageAccounts/networkAcls.defaultAction",
              "equals": "Allow"
            }
          ]
        },
        {
          "not": {
            "anyOf": [
              {
                "field": "type",
                "equals": "Microsoft.Web/sites"
              },
              {
                "field": "type",
                "equals": "Microsoft.Web/serverfarms"
              }
            ]
          }
        }
      ]
    },
    "then": {
      "effect": "[parameters('effect')]"
    }
  },
  "parameters": {
    "effect": {
      "type": "String",
      "metadata": {
        "displayName": "Effect",
        "description": "The effect determines what happens when the policy rule is evaluated to match"
      },
      "allowedValues": [
        "Audit",
        "Deny",
        "Disabled"
      ],
      "defaultValue": "Audit"
    }
  }
}