Deny assignment using blueprint for particular Management group about azure-blueprints HOT 1 OPEN

As blueprint only supports builtin role, we are not able to create custom role and leverage blueprint to do the assignment.

Are you referring to built-in roles for the role assignment artifact? You should be able to do either built-in or custom roles. My understanding is that custom roles are only partially supported at MG scope, but that is not a blueprints limitation. Blueprints will query for any available roles at the relevant scope.

If there are limitations with how blueprints is handling the application of deny assignments, then this will need to be addressed with deployment stacks, which is going to be a superset of blueprint assignment functionality. It's going to expose the full fidelity of settings for a deny assignment, including data actions. Deployment stacks is in private preview now and we are hoping to have a public preview out in the next 6 months.

from azure-blueprints.