Cannot deploy model in AI Foundry "715-123420: unusual activity for your account"

Hello Edmund Pafko,

Greetings! Thanks for raising this question in the Q&A forum.

The error you are seeing is not a quota, RBAC, or regional availability problem. Error 715-123420 is generated by Microsoft's automated fraud and abuse detection system that runs behind Azure AI Foundry and Azure OpenAI deployments. It is a subscription-level risk flag, separate from the resource provider itself, which is why the failure is instant and identical whether you go through the portal or the CLI. New subscriptions are scored more aggressively by this system, and creating a Foundry resource, deleting it, and immediately recreating one in a different region is a very common trigger, since that pattern resembles behavior seen in abuse attempts (rapid resource churn across regions on a fresh subscription).

This flag does not clear on its own in most cases and there is no portal setting or CLI flag that resets it. It has to be reviewed and lifted manually on Microsoft's backend.

Here is how to proceed:

1. Open an Azure support ticket specifically as a "Subscription Management" or "Quota" issue, not a general technical issue. Because this is a fraud/risk flag rather than a code or configuration bug, it should not require a paid technical support plan. If billing support redirected you, ask them to re-route the case to the Subscription and Billing support team as a subscription unblock request rather than closing it, since these fraud-flag cases are typically handled without a paid plan.
2. Include all three identifiers you already captured in the ticket: Trace ID ab416755-49f7-452b-ae3a-d9bcb8515e52, Client request ID fc36fd5b-b6d8-4c6e-9914-04bbdfd71b7e, and Service request ID 4c87fff9-51f2-4ea0-a011-dbb5246e84c6, along with the UTC timestamps of your deployment attempts and the subscription ID. These let the backend team locate the exact fraud detection event without needing to reproduce it.
3. Mention the resource churn explicitly (created in Poland Central, deleted, recreated in Sweden Central) since that is very likely what the detection system flagged, and naming it up front speeds up triage.
4. Do not delete and recreate the resource again while waiting. Additional churn on the same subscription can reinforce the flag rather than clear it.
5. Once the ticket is filed, deployments typically resume within one to a few business days after manual review, though there is no published SLA for this specific flag since it is a fraud control rather than a standard service limit.

If this answer helps you kindly accept the answer which will help others who have similar questions.

Best Regards,

Jerald Felix.

Hi @Edmund Pafko

Thank you posting your query in MS Q&A forum.

Could you please let us know if the issue has been resolved? if not, we have contacted you through a private message and requested additional details. Please share the requested information to help us proceed with the investigation.