Политика Azure для сетевой подсети

{
  "if": {
    "allOf": [{
        "field": "type",
        "equals": "Microsoft.Network/virtualNetworks/subnets"
      },
      {
        "not": {
          "field": "name",
          "match": "nncc-???-subnet"
        }
      },
      {
        "not": {
          "field": "name",
          "match": "nncc-????-subnet"
        }
      }
    ]
  },
  "then": {
    "effect": "Deny"
  }
}