Not able to create a VM

Hi @Aarav Maurya

The error identifies the cause: DenyAssignmentAuthorizationFailed

Your account has permission to perform: Microsoft.Resources/subscriptions/resourceGroups/write

but Azure is overriding that permission because of this deny assignment:

[UNUSUALACTIVITY] FULL DENY ASSIGNMENT ON / FOR ALL USERS ADDED

The deny assignments block Azure resource actions even when an RBAC role assignment otherwise grants the user permission.

Check Azure portal → Subscription → Access control (IAM) → Deny assignments and inspect that assignment's scope, denied actions, principals, exclusions, and System protected status. This is the supported method for examining effective deny assignments.

You can also list effective deny assignments with PowerShell: Get-AzDenyAssignment

This cmdlet lists deny assignments effective on the selected scope.

The assignment shown in your error is at scope /, so it can affect resources below that scope unless its configuration prevents inheritance or excludes your principal.

If the assignment is system-protected, Azure created it, and you can't edit or delete it directly. In that case, identify which Azure service/resource created it and address the deny assignment through that service or contact your Azure administrator/Microsoft Support.

Do not change your VM configuration or assign yourself additional RBAC roles. The error already confirms you have the required resourceGroups/write permission and that the deny assignment is blocking the operation.

References:

List Azure deny assignments

Get-AzDenyAssignment

Help make this community better for everyone: If this answer helped or resolved your issue, please accept it or upvote it. If not, share more details in a comment so we can continue the discussion and find the right solution. Thank you.