Azure ESLZ中拒绝Corp与Online管理组VNet对等的策略规则挑战

我曾尝试通过地址前缀范围实现需求：已知'corp'虚拟网络（VNet）的地址空间，但不清楚'online' VNet的地址范围，因此只能在策略条件中检查'corp' VNet的范围。

我使用的策略代码如下：

"parameters": {
  "corpVNetAddressPrefixes": {
    "type": "Array",
    "metadata": {
      "displayName": "Corp VNet Address Prefixes",
      "description": "The list of Corp Subscription VNets address prefixes."
    },
    "defaultValue": [
      "17.0.0.0/24"
    ]
  }
},
"policyRule": {
  "if": {
    "allOf": [
      {
        "field": "type",
        "equals": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings"
      },
      {
        "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetwork.id",
        "notcontains": "[subscription().id]"
      },
      {
        "anyOf": [
          {
            "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteVirtualNetworkAddressSpace.addressPrefixes[*]",
            "in": "[parameters('corpVNetAddressPrefixes')]"
          },
          {
            "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/remoteAddressSpace.addressPrefixes[*]",
            "in": "[parameters('corpVNetAddressPrefixes')]"
          },
          {
            "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/localVirtualNetworkAddressSpace.addressPrefixes[*]",
            "in": "[parameters('corpVNetAddressPrefixes')]"
          },
          {
            "field": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings/localAddressSpace.addressPrefixes[*]",
            "in": "[parameters('corpVNetAddressPrefixes')]"
          }
        ]
      }
    ]
  },
  "then": {
    "effect": "deny"
  }
}

但该方案仅对一个对等资源生效——创建VNet对等连接时会生成本地和远程两个资源。核心问题是别名localVirtualNetworkAddressSpace.addressPrefixes[*]和virtualNetworkPeerings/localAddressSpace.addressPrefixes[*]无法正常工作，它们并未出现在资源JSON结构中，导致对应的条件判断失效。我也曾尝试通过订阅标签实现，但目前没有可用的remoteVirtualNetwork.tags别名（可提交工单申请添加该别名）。

内容的提问来源于stack exchange，提问作者Aslam Bagwan