I have a policy that denies changes on resources that have the tag “source:terraform”.
However I want that policy to only block changes from the ui and not from azure devops.
So I want to exclude the technical user that azure devops is using, from the policy, so that changes on terraform resources via ui are not possible, but via the azure devops pipeline.

Is it possible for an azure policy to add some users, that are excluded from that policy?