How to assign an Azure Policy to a resource group