Allow specific user access in SCP

Hello,

I am playing with SCP, and trying to implemented below steps:

1) I’ve create an organisation and defined a new ou under root (ORG1)

2) I’ve added the root user for the account 1111111111 under ORG1 

3) I’ve create an admin account in account 1111111111 with full admin privileges

4) Root organisation has the OOTB FullAWSAccess associated to it

5) I want to deny all the permissions to users (root account as well) in ou ORG1 expect for an IAM user – admin

6) I’ve defined below SCP in ORG1, but when I log into account 1111111111 with user admin, user hasn’t got any permission.

Could you please suggest if this scenario is feasible with SCP?

Nico

{

"Version": "2012-10-17",

"Statement": [

{

"Sid": "Statement1",

"Effect": "Deny",

"Resource": [

"*"

],

"NotPrincipal":

{"AWS":

["arn:aws:iam::1111111111:user/admin"]

}

}

]

}