Security group exclusion from a access control policy

Hi there. I raised a question some days ago and I can,t find my answer. let me clear my question again. in my scenario, I integrated IAM with the active directory, create access control policies for web access management, and then linked policies with security groups created on the active directory. I am creating a block internet policy for users who are not members of any security group. by default, IAM allows all web traffic to that user who is not a member of any security group. so I decided to create a block rule at the bottom and exclude the above security groups which are already linked with policies. by doing this, random users will be blocked.

I am facing a problem that how to exclude a user or a security group while creating a policy.

Step 1. Open the Group Policy Object that you want to apply an exception and then click on the “Delegation” tab and then click on the “Advanced” button. Step 2. Click on the “Add” button and select the group (recommended) that you want to exclude from having this policy

Create a policy with Implicit deny.

Just an advice, list down all the allowed/blocked sites, who among the users are allowed/no access to that specific sites. from there, you can create a definite policy

Check the policy

check the policy and its order

Allow policies should be on the top of the policies then the block will follow.

The AD should integrate on the IAM then the policy comes

check your policies with appropriate priorities

There are many policies which you could utilize, like for example you can select some users from AD to allow youtube, email or you can deny all