1. Under **Target resources**, select the following options:
1. Select what this policy applies to **Resources (formerly cloud apps)**.
1. Include **All resources (formerly 'All cloud apps')**
1. Exclude **Select resources**.
1. Select **Select resources based on attributes**.
1. Set **Configure** to **Yes**.
1. Select the Attribute we created earlier called **Department**.
1. Set **Operator** to **Contains**.
1. Set **Value** to **HR**.
1. Under **Access controls** > **Grant**:
1. Select **Block**.
1. Select **Select**.
1. Under **Target resources**, select the following options:
1. Select what this policy applies to **Resources (formerly cloud apps)**.
1. Include **All resources (formerly 'All cloud apps')**
1. Exclude **Select resources**.
1. Select **Select specific resources**.
1. Using the enhanced object picker, switch between the tabs **All**, **Enterprise applications**, and **Agent blueprints** to select individual resources.
:::image type="content" source="media/agent-id/enhanced-object-picker.png" alt-text="Screenshot of the enhanced object picker with tabs for All, Enterprise applications, and Agent blueprints, showing resource selection options." lightbox="media/agent-id/enhanced-object-picker.png":::
1. Select **Select**.
1. Under **Target resources**, select the following options:
1. Select what this policy applies to **Resources (formerly cloud apps)**.
1. Include **All resources (formerly 'All cloud apps')**
1. Under **Access controls** > **Grant**:
1. Select **Block**.
1. Select **Select**.
1. Under **Target resources**, select the following options:
1. Select what this policy applies to **Resources (formerly cloud apps)**.
1. Include **All resources (formerly 'All cloud apps')**
1. Under **Access controls** > **Grant**:
1. Select **Block**.
1. Select **Select**.