diff --git a/common/config/rush/pnpm-lock.yaml b/common/config/rush/pnpm-lock.yaml
index b14461ae2a..04e5a536ca 100644
--- a/common/config/rush/pnpm-lock.yaml
+++ b/common/config/rush/pnpm-lock.yaml
@@ -4456,7 +4456,7 @@ packages:
     dev: false
 
   file:projects/powershell.tgz:
-    resolution: {integrity: sha512-/cTXzGUZTDhTv00X96g/ev5R8DhTdsQMIKOfHnwTU5XV+VHjonfZkNAE/F4J6Nx+PlUMQDOpu2l8WODdTfbxZQ==, tarball: file:projects/powershell.tgz}
+    resolution: {integrity: sha512-g+2G98k1uy6WYWIz2YpqovxGt8rcL0RxWA6Zx8iROMAxurDEnhto1UzalzXAuGu7QSqy7suBvPQGATb0Y77W9A==, tarball: file:projects/powershell.tgz}
     name: '@rush-temp/powershell'
     version: 0.0.0
     dependencies:
@@ -4492,7 +4492,7 @@ packages:
     dev: false
 
   file:projects/typespec-powershell.tgz:
-    resolution: {integrity: sha512-nJTut+dJB/qoOsof76bauP5BhxsrcPuz+QkxF3JSf+bQhhmk+SGESqigrJpvNCH1uj1w7rzg69TvWdPR9ihl1g==, tarball: file:projects/typespec-powershell.tgz}
+    resolution: {integrity: sha512-FEyIs94S0ytHp2gxuA2ZcEN7YOzvAPKpxNgNDEOEb3aK5brakvfUK/qW8UZaFgd2zA6+pPehphG/XlHsvshnDw==, tarball: file:projects/typespec-powershell.tgz}
     name: '@rush-temp/typespec-powershell'
     version: 0.0.0
     dependencies:
diff --git a/powershell/plugins/create-commands-v2.ts b/powershell/plugins/create-commands-v2.ts
index d339bac7ad..56fd1ba428 100644
--- a/powershell/plugins/create-commands-v2.ts
+++ b/powershell/plugins/create-commands-v2.ts
@@ -169,6 +169,13 @@ export /* @internal */ class Inferrer {
     };
     const disableGetPut = await this.state.getValue('disable-getput', false);
     const disableTransformIdentityType = await this.state.getValue('disable-transform-identity-type', false);
+    const disableTransformIdentityTypeForOperation = await this.state.getValue('disable-transform-identity-type-for-operation', []);
+    const optsToExclude = new Array<string>();
+    if (disableTransformIdentityTypeForOperation) {
+      for (const item of values(disableTransformIdentityTypeForOperation)) {
+        optsToExclude.push(item);
+      }
+    }
     this.state.message({ Channel: Channel.Debug, Text: 'detecting high level commands...' });
     for (const operationGroup of values(model.operationGroups)) {
       let hasPatch = false;
@@ -206,11 +213,15 @@ export /* @internal */ class Inferrer {
             || !hasPatch && putOperation && this.IsManagedIdentityOperation(putOperation))) {
           await this.addVariants(putOperation.parameters, putOperation, this.createCommandVariant('create', [operationGroup.$key], [], this.state.model), '', this.state, [getOperation], CommandType.ManagedIdentityUpdate);
         } else if (!disableTransformIdentityType && !supportsCombineGetPutOperation && hasPatch && patchOperation && this.IsManagedIdentityOperation(patchOperation)) {
+          if (!optsToExclude.includes(patchOperation.operationId ?? '')) {
+            const transformIdentityTypeErrorMessage = `Parameter IdentityType in operation '${patchOperation.operationId}' can not be transformed as the best practice design. See https://github.com/Azure/azure-powershell/blob/main/documentation/development-docs/design-guidelines/managed-identity-best-practices.md#frequently-asked-question to mitigate this issue.`;
+            this.state.message({ Channel: Channel.Error, Text: transformIdentityTypeErrorMessage });
+            throw new Error(transformIdentityTypeErrorMessage);
+          }
           // bez: add patch operation back and disable transforming identity type
           for (const variant of await this.inferCommandNames(patchOperation, operationGroup.$key, this.state)) {
             await this.addVariants(patchOperation.parameters, patchOperation, variant, '', this.state);
           }
-          await this.state.setValue('disable-transform-identity-type', true);
         } else if (!disableGetPut && !hasPatch && supportsCombineGetPutOperation) {
           /* generate variants for Update(Get+Put) for subjects only if: 
            - there is a get operation 
@@ -222,11 +233,16 @@ export /* @internal */ class Inferrer {
           await this.addVariants(putOperation.parameters, putOperation, this.createCommandVariant('create', [operationGroup.$key], [], this.state.model), '', this.state, [getOperation], CommandType.GetPut);
         }
       } else if (this.isAzure && !disableTransformIdentityType && patchOperation && this.IsManagedIdentityOperation(patchOperation)) {
+        if (!optsToExclude.includes(patchOperation.operationId ?? '')) {
+          const transformIdentityTypeErrorMessage = `Parameter IdentityType in operation '${patchOperation.operationId}' can not be transformed as the best practice design. See https://github.com/Azure/azure-powershell/blob/main/documentation/development-docs/design-guidelines/managed-identity-best-practices.md#frequently-asked-question to mitigate this issue.`;
+          this.state.message({ Channel: Channel.Error, Text: transformIdentityTypeErrorMessage });
+          throw new Error(transformIdentityTypeErrorMessage);
+        }
+
         // bez: add variants back and disable transforming identity type as no put or get
         for (const variant of await this.inferCommandNames(patchOperation, operationGroup.$key, this.state)) {
           await this.addVariants(patchOperation.parameters, patchOperation, variant, '', this.state);
         }
-        await this.state.setValue('disable-transform-identity-type', true);
       }
     }
     // for (const operation of values(model.http.operations)) {