How to deny/local-down resource "APIM SKU premium"

[cnissa01]

Hi There,
I have a requirement for locking down APIM Premium SKU. Can I get some help doing this by using this "deny resource options". It's clear using this deny resource module. I guess I'm after how can I lock it down to the specific SKU level. thanks in advance.

[gettek]

You can probably add an additional condition below resource types to also check for sku or sku.name using its Alias:

(Get-AzPolicyAlias -NamespaceMatch "Microsoft.ApiManagement").Aliases | ? {$_.name -like "*sku*"}  | Select-Object Name,DefaultPath | ConvertTo-Json

[
  {
    "Name": "Microsoft.ApiManagement/service/sku.name.externalDocs",
    "DefaultPath": "sku.name.externalDocs"
  },
  {
    "Name": "Microsoft.ApiManagement/service/sku.name",
    "DefaultPath": "sku.name"
  },
  {
    "Name": "Microsoft.ApiManagement/service/sku.capacity",
    "DefaultPath": "sku.capacity"
  },
  {
    "Name": "Microsoft.ApiManagement/service/sku",
    "DefaultPath": "sku"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].skuType",
    "DefaultPath": "properties.additionalLocations[*].skuType"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].skuUnitCount",
    "DefaultPath": "properties.additionalLocations[*].skuUnitCount"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].sku.name.externalDocs",
    "DefaultPath": "properties.additionalLocations[*].sku.name.externalDocs"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].sku.name",
    "DefaultPath": "properties.additionalLocations[*].sku.name"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].sku.capacity",
    "DefaultPath": "properties.additionalLocations[*].sku.capacity"
  },
  {
    "Name": "Microsoft.ApiManagement/service/additionalLocations[*].sku",
    "DefaultPath": "properties.additionalLocations[*].sku"
  }
]