@Chinmay Vartak - Welcome to Microsoft Q&A and thanks for reaching out.
For security or compliance, your subscription administrators might assign policies that limit how resources are deployed. For example, policies that prevent creating public IP addresses, network security groups, user-defined routes, or route tables.
To resolve RequestDisallowedByPolicy errors, review the resource policies and determine how to deploy resources that comply with those policies. The error message displays the names of the policy definition and policy assignment.
Please take a look at this document for more info : error-policy-requestdisallowedbypolicy
UPDATE:
So I have confirmed with Product team and was told that there is no way to set the tag on a managed resource group today, so this would fail. You would have to add a policy exception to exempt the Managed app and its resource group from this policy.
Hope this helps. and please feel free to reach out if you have any further questions.
------------------------------------------------------------------
If the above response was helpful, please feel free to "Accept as Answer" and "Upvote" the same so it can be beneficial to the community.