Grafana Deployment Ignored RoleAssignment Deny Policy

We have a custom policy implemented that denies role assignments with a PrincipalType of User. The intended effect is to only have role assignments tied to Groups, and not individual users.

```json
"policyRule": {
"if": {
"allOf": [
{
"like": "*Microsoft.Authorization/roleAssignments",
"field": "type"
},
{
"field": "Microsoft.Authorization/roleAssignments/principalType",
"equals": "User"
}
]
},
"then": {
"effect": "deny"
}
}

```

The policy works as intended for most cases, but for Grafana deployments via the Portal, the policy does not deny the creation of a Grafana Administrator role assignment to the user who created the Managed Grafana instance through the portal. This role assignment will show as non-compliant in the policy dashboard, but it is not denied as it should be.

If the user attempts to add any additional role assignments (including the Grafana specific roles) for a user after the Grafana instance is created, the policy denies it as it should.

The issue names no repository file, test, or entry point; it provides only the Azure Policy rule and Portal-based Grafana deployment steps. Start by reproducing the Managed Grafana creation with the policy enabled, then trace the deployment behavior. Done means the user role assignment is denied rather than created as non-compliant.

Written by the indexing model from the issue text.