Azure for Students enabled but deny-all policy blocks resource creation and support requests

An Enabled subscription can still be prevented from creating resources by an Azure Policy assignment inherited from a management group.

RequestDisallowedByPolicy means Azure Resource Manager evaluated the request and a policy with a deny effect blocked it. The policy name and management-group scope shown in the error are therefore the key details:

• Policy: Deny-All-for_Quarantaene-Group
• Management group: quarantaene-schatten-it

A subscription owner normally cannot remove or exempt the subscription from a policy assigned at a parent management group unless that user also has the required policy permissions at the management-group scope. Azure for Students eligibility does not override inherited Azure Policy.

First, determine who controls the management group:

1. In Azure Policy > Assignments, change the scope to the subscription and enable inherited assignments.
2. Open the deny assignment and record its assignment ID, definition ID, scope and any exemption information.
3. Check Management groups and Access control (IAM) to see whether the management group belongs to a school, employer, lab, reseller or another tenant administrator.
4. Confirm that the signed-in tenant is the intended tenant and that the subscription has not been transferred into an organization-controlled hierarchy.

If the management group is controlled by the school or another organization, its Azure administrator must remove the quarantine assignment, create an exemption, or move the subscription to an appropriate management group. Microsoft Support should not bypass a legitimate customer-managed policy without authorization from that tenant.

If neither you nor an organization you recognize controls quarantaene-schatten-it, treat this as a subscription/account-management issue. Do not publish the subscription ID here. Capture the policy-assignment ID and tenant ID privately and contact Azure subscription-management support.

If the portal will not create a support request using the affected subscription, use the Azure support entry point while signed in and choose Subscription management or Account/Subscription access. Subscription-management support does not require a paid technical-support plan. Include:

• Subscription ID and tenant ID
• Policy-assignment and definition IDs
• Management-group ID
• Full RequestDisallowedByPolicy response
• Screenshot of the portal message preventing support-request creation

The immediate resolution must be performed at the management-group or subscription-management level; recreating resource groups, changing regions or retrying deployments will not bypass an inherited deny policy.

References:

• Azure Policy overview
• Create an Azure support request

Hi @Fahim Mahmud

The policy name tells us what happened. "Deny-All-for_Quarantaene-Group" is assigned on a management group called quarantaene-schatten-it ("quarantine shadow IT"). That isn't a Microsoft policy. It belongs to the organization that owns the Microsoft Entra tenant your account is in, most likely your university.

When a student creates a subscription with their school account, the subscription lands in the school's tenant. Here the school's IT team automatically moves new, unknown subscriptions into a quarantine group that blocks everything. That's why even an empty resource group fails, and why support requests are blocked too.

1. Contact your university's IT or cloud team. Give them the subscription ID (privately) and the policy and management group names from the error.
2. Ask them either to move the subscription out of the quarantine group, or to confirm it isn't allowed in their tenant.
3. If they don't allow student subscriptions in the tenant, you'll need Azure under a different account that isn't in the university's tenant. Ask them which account they recommend for coursework.

Microsoft moderators can't override a policy that your tenant's admins assign, so the university is the one to fix it.

Do you know who manages Azure for your university?

If the university unblocks it, please consider accepting it as the answer. If they say it isn't their policy, let me know and I'll be happy to keep helping.

Reference:

• https://learn.microsoft.com/en-us/azure/governance/policy/troubleshoot/general