Azure Subscription Disabled Due to Alleged Suspicious Activity #2607270040008564

For a subscription disabled for suspicious activity or an acceptable use policy concern, the next step is to create a Subscription management support request and ask for the subscription to be reviewed and re-enabled. The review is handled by the security team.

Supported guidance:

1. In the Azure portal, open Help + support and select Create a support request.
2. Search for re-enable subscription.
3. Select Subscription management.
4. Select the affected subscription.
5. If suggested articles appear, continue with Create a support request rather than stopping on the recommendations.
6. Use:
   • Problem type: Re-enable my subscription
   • Problem subtype: Could not reactivate by self-service
7. Complete the remaining details and submit the request.

What can be answered from the available guidance:

• What specific activity triggered the suspension?
  The available guidance only states that Azure can disable a subscription when suspicious activity or acceptable use policy violations are detected. It does not provide the exact triggering event in an individual case.
• How can the issue be reviewed and remediated?
  Review sign-in activity and subscription activity for unauthorized actions:
  • Check Microsoft Entra sign-in logs for unusual sign-in patterns.
  • Check the Azure Activity Log for unauthorized billing, usage, or configuration changes.
  • Review spending anomalies in Azure Cost Management.
  • If compromised resources are found, disable or delete them and clean up the environment.
• What is required to have the subscription re-enabled?
  Submit the support request above so the security team can review the case and re-enable the subscription if appropriate.
• Is additional information needed from the subscription owner?
  The guidance supports providing the required details in the support request. If the security team needs more verification or information, that is handled through the support case.

If the support flow loops back to recommended articles, use Return to support request and continue the case creation flow instead of selecting the suggested solutions.

• Reactivate a disabled Azure subscription
• Detect and respond to security alerts
• How do I rectify a disabled Azure Subscription? - Microsoft Q&A
• Loop trying to submit support request in Azure - Microsoft Q&A