An Azure service that is used to implement corporate governance and standards at scale for Azure resources.
Hi @LAXMAN SHAH Thanks for sharing the error details this actually isn't a simple region restriction. The RequestDisallowedByPolicy message you're seeing points to a deny-all policy assignment inherited from a management group, not the "Allowed resource deployment regions" policy you initially suspected.Why this is happening
Every Azure subscription sits under exactly one management group, and it automatically inherits any policies and role assignments applied there. In your case, the subscription appears to be parented under a management group (something like "Placeholder‑Block" or similar staging/quarantine group) that carries a deny-all rule so no resource, in any region, can be created until that's addressed.
Steps to confirm and fix
- Capture the full error JSON (not just the display message): run your deployment with
--debugor expand the failed operation in the Azure portal's Activity Log. Look for thepolicyAssignment.idandpolicyDefinition.idthe last segment of each is the assignment/definition name. - Check your management group hierarchy:
- az account management-group list -o table
- If this returns empty or errors, you don't have visibility above the subscription that's the key signal for what to do next.
- If the intended parent is the tenant root management group: moving a subscription to the root doesn't require the usual write permissions, since it's the default landing spot for all new subscriptions . You can try:
- az account management-group subscription add --name "<TenantRootGroupId>" --subscription "<sub-id>"
- Allow up to 30 minutes for the change to propagate, since Azure Resource Manager caches the management group hierarchy .
- If step 3 fails with an authorization error: The management group likely belongs to your organization/institution's tenant. In that case, you'll need your tenant's Azure admin to either re-parent the subscription or create a scoped policy exemption:
- az policy exemption create --name "StudentSubExemption" --policy-assignment "<assignment-id>" --scope "/subscriptions/<sub-id>" --exemption-category "Waiver"
Reference documentation:
- Manage Azure subscriptions at scale with management groups - covers moving subscriptions and the root management group exception
- Organize your resources with management groups - explains how policy/RBAC inheritance cascades from parent to subscription Resource Group / can’t create any resource” behavior you’re seeing.
If you have further questions regarding this answer, feel free to click "Comment". If you find the answer helpful, please click "upvote" and accept it. This helps the community by allowing others with similar queries to easily find the solution.