Share via

Resource deployment on Azure failed

Scott Lu 0 Reputation points
2026-03-15T05:52:58.91+00:00

I was trying to create a B2pts vm in Japan East with my new student subscription, but failed with the following error
it said that the deployment violate the policy
I am wondering what was going wrong, how can it be resolved

{
    "authorization": {
        "action": "Microsoft.Resources/deployments/validate/action",
        "scope": "/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596/resourceGroups/My_VMs/providers/Microsoft.Resources/deployments/vnet1-1773552761403"
    },
    "caller": "myemail",
    "channels": "Operation",
    "claims": {
        "aud": "https://management.core.windows.net/",
        "iss": "https://sts.windows.net/3c2c3a7c-0193-436b-91a6-875f74a2f1c2/",
        "iat": "1773551565",
        "nbf": "1773551565",
        "exp": "1773556772",
        "http://schemas.microsoft.com/claims/authnclassreference": "1",
        "acrs": "p1",
        "aio": "AeQAG/8bAAAA3P9jb13FPXkauJEjZ0B2/aapoOfVfzmWFwGJ8u72tcuYjvSlvkO2TX0sJja6pKFxITFtEnVNo2ewmYPeB9gABgj1R9wTbJnu1bYdbz35R2ZZPjp0t1HYOw40AUotEgyhk1SDKBizDJ1N1oLqwGzjbhjLPei2WX95YXYtuY2kyJhz/3XXBL/CN9OODUj7y3EL0G1W1l0G6n5RL1DSPXM6P8w8JrowP1odqmUkssd8PJKppxtjKDhOv5RKmJ8CgIqmZ+/TcOeW33gpYGII9rwYGZ37xi1EreuhZhwx2UoryLY=",
        "altsecid": "1:live.com:0003BFFDFDA5C634",
        "http://schemas.microsoft.com/claims/authnmethodsreferences": "pwd,mfa",
        "appid": "c44b4083-3bb0-49c1-b47d-974e53cbdf3c",
        "appidacr": "0",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress": "******@outlook.com",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname": "Lu",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname": "Scott",
        "groups": "e8b2f013-f872-4c36-bd4b-bcbdb602b784",
        "http://schemas.microsoft.com/identity/claims/identityprovider": "live.com",
        "idtyp": "user",
        "ipaddr": "myip",
        "name": "Scott Lu",
        "http://schemas.microsoft.com/identity/claims/objectidentifier": "48021e42-38c5-43f2-a7da-c8b417455cd9",
        "puid": "10032005B21EB8EB",
        "rh": "1.AWEBfDosPJMBa0ORpodfdKLxwkZIf3kAutdPukPawfj2MBMAALphAQ.",
        "http://schemas.microsoft.com/identity/claims/scope": "user_impersonation",
        "sid": "0030189a-eee3-aa44-2313-4645edb0cd43",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier": "vapYSeeMa3_wgwb34-W92R4GOb_JTNWM3D9velBdaoM",
        "http://schemas.microsoft.com/identity/claims/tenantid": "3c2c3a7c-0193-436b-91a6-875f74a2f1c2",
        "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name": "live.com#myemail",
        "uti": "PDnuaAbMJE685ft8AkV3AA",
        "ver": "1.0",
        "wids": "62e90394-69f5-4237-9190-012177145e10",
        "xms_act_fct": "5 3",
        "xms_edov": "true",
        "xms_ftd": "BZnMXbLm2XIzSIxqULZIb1a1oVGwrSQSOnCyrXGdMSIBdXNzb3V0aC1kc21z",
        "xms_idrel": "1 10",
        "xms_sub_fct": "4 3",
        "xms_tcdt": "1773549588"
    },
    "correlationId": "a92c9d6b-9d8f-44d1-b847-1811e2b7f49b",
    "description": "",
    "eventDataId": "a7dd3ca5-616e-449d-84ee-b19f8902dcfa",
    "eventName": {
        "value": "EndRequest",
        "localizedValue": "结束请求"
    },
    "category": {
        "value": "Policy",
        "localizedValue": "策略"
    },
    "eventTimestamp": "2026-03-15T05:32:48.0041394Z",
    "id": "/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596/resourceGroups/My_VMs/providers/Microsoft.Network/virtualNetworks/vnet1/events/a7dd3ca5-616e-449d-84ee-b19f8902dcfa/ticks/639091495680041394",
    "level": "Error",
    "operationId": "a92c9d6b-9d8f-44d1-b847-1811e2b7f49b",
    "operationName": {
        "value": "Microsoft.Authorization/policies/deny/action",
        "localizedValue": "'deny' Policy action."
    },
    "resourceGroupName": "My_VMs",
    "resourceProviderName": {
        "value": "Microsoft.Network",
        "localizedValue": "Microsoft.Network"
    },
    "resourceType": {
        "value": "Microsoft.Resources/deployments",
        "localizedValue": "Microsoft.Resources/deployments"
    },
    "resourceId": "/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596/resourceGroups/My_VMs/providers/Microsoft.Network/virtualNetworks/vnet1",
    "status": {
        "value": "Failed",
        "localizedValue": "失败"
    },
    "subStatus": {
        "value": "",
        "localizedValue": ""
    },
    "submissionTimestamp": "2026-03-15T05:33:42Z",
    "subscriptionId": "c1635ee4-a0c6-4fc6-bcc3-613c74c5b596",
    "tenantId": "3c2c3a7c-0193-436b-91a6-875f74a2f1c2",
    "properties": {
        "isComplianceCheck": "False",
        "resourceLocation": "japaneast",
        "ancestors": "3c2c3a7c-0193-436b-91a6-875f74a2f1c2",
        "policies": "[{\"policyDefinitionId\":\"/providers/Microsoft.Authorization/policyDefinitions/b86dabb9-b578-4d7b-b842-3b45e95769a1\",\"policyDefinitionName\":\"b86dabb9-b578-4d7b-b842-3b45e95769a1\",\"policyDefinitionDisplayName\":\"Allowed resource deployment regions\",\"policyDefinitionVersion\":\"1.0.0\",\"policyDefinitionEffect\":\"deny\",\"policyAssignmentId\":\"/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596/providers/Microsoft.Authorization/policyAssignments/sys.regionrestriction\",\"policyAssignmentName\":\"sys.regionrestriction\",\"policyAssignmentDisplayName\":\"Allowed resource deployment regions\",\"policyAssignmentScope\":\"/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596\",\"policyExemptionIds\":[],\"policyEnrollmentIds\":[]}]",
        "eventCategory": "Policy",
        "entity": "/subscriptions/c1635ee4-a0c6-4fc6-bcc3-613c74c5b596/resourceGroups/My_VMs/providers/Microsoft.Network/virtualNetworks/vnet1",
        "message": "Microsoft.Authorization/policies/deny/action",
        "hierarchy": ""
    },
    "relatedEvents": []
}
Azure Policy
Azure Policy

An Azure service that is used to implement corporate governance and standards at scale for Azure resources.

0 comments

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Siva shunmugam Nadessin 7,735 Reputation points Microsoft External Staff Moderator
    2026-03-16T09:10:09.4433333+00:00

    Hello Scott Lu,

    Thank you for reaching out to the Microsoft Q&A forum.

    It looks like your VM deployment in Japan East is being blocked by an Azure Policy called “Allowed resource deployment regions” (sys.regionrestriction). Your student subscription has a policy assignment at the subscription level that only allows certain regions, and Japan East isn’t on the list—so any deployment there gets denied.

    Here’s how you can resolve it:

    1. Identify the blocking policy
      • In the Azure portal, go to Policy → Assignments.
      • Find the assignment named “Allowed resource deployment regions” (or use the policyAssignmentId from your error).
      • Click into it and view the Parameters to see which regions are allowed.
    2. Deploy in an allowed region
      • If you don’t have permissions to change the policy, pick one of the allowed regions listed in that policy (for example, East US or West Europe) and recreate your VM there.
    3. Modify the policy (if you have rights)
      • Still in the Policy Assignments blade, select Edit assignment on “Allowed resource deployment regions.”
      • Add japaneast to the allowedLocations parameter, save, and retry your deployment.
    4. Request an exemption or policy change
      • If you can’t edit policies yourself, share the error details (especially the policyAssignmentId and policyDefinitionId) with your Azure subscription admin. Ask them to either include Japan East in the allowed regions or create an exemption for your resource group.

    Once the policy is updated or you switch to an allowed region, your B2 pts VM deployment should succeed.

    Hope that helps!

    References

  2. TP 155.2K Reputation points Volunteer Moderator
    2026-03-15T06:21:52.7366667+00:00

    Hi Scott,

    Azure for Students restricts which regions you can deploy resources to. Typically you are restricted to five different regions, and these vary for each person.

    Please navigate to Azure Policy -- Authoring -- Assignments using link below:

    https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Assignments

    Click on assignment named Allowed resource deployment regions

    User's image

    Examine Allowed locations Parameter value for list of regions, similar to below (regions in screenshot are different than yours):

    User's image

    The regions shown in your Parameter value are the ones you are allowed to deploy resources to. Please try to create resource in one of these regions and let me know the results.

    Please click Accept Answer and upvote if the above was helpful.

    Thanks.

    -TP

    0 comments
  3. Q&A Assist
    2026-03-15T05:53:11.4966667+00:00
    AI generated content. This question contains an answer created with AI from Q&A Assist. Learn more

    The deployment failed because an Azure Policy assignment on the subscription explicitly denies creating resources in the Japan East region.

    From the event payload:

    • policyDefinitionDisplayName: "Allowed resource deployment regions"
    • policyDefinitionEffect: "deny"
    • policyAssignmentName: "sys.regionrestriction"
    • resourceLocation: "japaneast"

    This means the subscription has a region restriction policy that only allows certain regions. japaneast is not in that allowed list, so the policy blocks (denies) the deployment with the Microsoft.Authorization/policies/deny/action event.

    To resolve this, one of the following must happen:

    1. Deploy to an allowed region
      Change the VM (and related resources like the VNet) to a region that is permitted by the "Allowed resource deployment regions" policy. This is the usual mitigation when hitting RequestDisallowedByPolicy: adjust the deployment so it complies with the policy.
    2. Have the policy scope changed by an administrator
      Only a subscription/tenant administrator (or whoever manages governance for the environment) can:
      • Modify the "Allowed resource deployment regions" policy definition/parameters to include japaneast, or
      • Remove or change the sys.regionrestriction policy assignment, or
      • Add an exclusion or exemption for a specific resource group or resource so that the policy is not enforced there.
      For example, an admin can:
      • Go to Azure Policy → Assignments.
      • Open the "Allowed resource deployment regions" (sys.regionrestriction) assignment.
      • Add an exclusion for a specific resource group if an exception is required, or update the allowed regions list.

    Student subscriptions are typically governed by strict policies set by the program or institution, so changing the policy or adding exclusions might not be possible. In that case, the only workable option is to deploy the VM in a region that is allowed by the policy.

    References:

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.