Azure policy - "deny" subscription creation if certain tags are not set

Question

I have created the azure policy below but I am still able to create new subscriptions. The same if conditions are used in an Azure BuiltIn definition that modifies-adds tags to subscriptions. Any hints?

{
  "mode": "All",
  "policyRule": {
    "if": {
      "allOf": [
        {
          "field": "type",
          "equals": "Microsoft.Resources/subscriptions"
        },
        {
          "field": "[concat('tags[', parameters('tagName'), ']')]",
          "exists": "false"
        }
      ]
    },
    "then": {
      "effect": "deny"
    }
  },
  "parameters": {
    "tagName": {
      "type": "String",
      "defaultValue": "CostCenter"
    }
  }
}

Answer 1

Just got an answer from Microsoft Support. It seems this is the current design that applies only to subscriptions being created from the portal. If the subscription is deployed programatically, the policy does its job.