Issue: Policy blocking App Service deployment in all regions

Hello Alhomiyn Wafi Abdulaziz M

Thank you for reaching out to the Microsoft Q&A forum. 

When investigated it looks like your App Service creation is being blocked by an Azure Policy in your Azure for Students subscription—specifically one that restricts which regions you can use. Here’s how you can unblock yourself:

Identify the blocking policy

• In the Azure portal go to Policy > Authoring > Assignments

• Find the assignment named Allowed resource deployment regions

• Click into it and look at the “Allowed locations” parameter—those are the only regions you can deploy into

Redeploy into an allowed region

• When you create your App Service, pick one of the regions listed under Allowed locations

• That should satisfy the policy and your deployment will succeed

If you really need a region that isn’t on that list

a) If you have Owner or Policy Contributor rights follow below steps:

• In Policy > Assignments select “Allowed resource deployment regions” > Edit assignment
• Add your desired region to the Allowed locations list and save

b) If you don’t have rights:

• Share the policyAssignmentId and policyDefinitionId (you can find these in the Activity Log or via CLI) with your subscription admin
• Ask them to either update the allowed locations or create a policy exemption

If the issue persists, Let me know:

• Which region you originally tried?
• The exact error you see in the Activity Log?
• Whether you have permissions to edit policy assignments?

Let me know if any further queries - feel free to reach out!

Reference list

1. Troubleshoot RequestDisallowedByPolicy https://learn.microsoft.com/azure/governance/policy/troubleshoot/general#requestdisallowedbypolicy-error
2. Operation blocked by Policy (what causes it & how to view in Activity Log) https://supportabilityhub.microsoft.com/solutions/apollosolutions/65e4479d-09ca-d2b0-a863-f8fa7473ae85/ebea4d37-9f36-4fdd-b93a-f1dcde729745
3. Resolve RequestDisallowedByPolicy for Azure Resource Manager Deployments https://learn.microsoft.com/azure/azure-resource-manager/troubleshooting/error-policy-requestdisallowedbypolicy
4. (For custom policies) Creating Policies to Block Specific Deployment Types in Azure OpenAI https://learn.microsoft.com/azure/ai-services/openai/how-to/deployment-types#policy-examples

Hi,

Azure for Students restricts which regions you can deploy resources to. Typically you are restricted to five different regions, and these vary for each person.

Please navigate to Azure Policy -- Authoring -- Assignments using link below:

https://portal.azure.com/#view/Microsoft_Azure_Policy/PolicyMenuBlade/~/Assignments

Click on assignment named Allowed resource deployment regions

Examine Allowed locations Parameter value for list of regions, similar to below (regions in screenshot are different than yours):

The regions shown in your Parameter value are the ones you are allowed to deploy resources to. Please try to create resources in one of these regions and let me know the results.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

The error is caused by an Azure Policy assignment in the subscription that denies creation of the App Service resource type, so deployments are blocked in all regions.

To resolve this, the blocking policy must be identified and updated or removed so that the required App Service resource types are allowed.

1. Identify the blocking policy from the error
   • The RequestDisallowedByPolicy error includes the policy definition name and policy assignment name that blocked the request. Note these names from the deployment error details (in the portal Activity log, CLI, or PowerShell output).
2. Inspect the policy definition and assignment
   • Using Azure CLI:
     • Get policy definition details:

              az policy definition show --name <policy-definition-name>
       

     • Get policy assignment details (scope may be subscription or resource group):

              az policy assignment show --name <policy-assignment-name> --resource-group <rg-name>
       

   • Using PowerShell:
     • Get policy definition:

              $subid = (Get-AzContext).Subscription.Id
              $defname = "<policy definition name>"
              (Get-AzPolicyDefinition -Id "/subscriptions/$subid/providers/Microsoft.Authorization/policyDefinitions") |
                Where-Object -Property Name -EQ -Value $defname |
                ConvertTo-Json -Depth 10
       

     • Get policy assignment:

              $rg = Get-AzResourceGroup -Name "<resource group name>"
              $assignmentname = "<policy assignment name>"
              Get-AzPolicyAssignment -Name $assignmentname -Scope $rg.ResourceId | ConvertTo-Json -Depth 5
       

3. Review the policy rules
   • In the policy definition JSON, review the if/then rules to see what is being denied. Common patterns include:
     • “Allowed resource types” policies that only permit a specific list of resource types.
     • Policies that deny certain configurations (for example, public network access, specific SKUs, or regions).
   • For “Allowed resource types” style policies, App Service types such as Microsoft.Web/serverfarms or Microsoft.Web/sites may not be included, causing all App Service deployments to be denied.
4. Remediate the policy
   • If the policy is intended to restrict resource types:
     • Edit the policy assignment parameters to include the App Service resource types that must be deployed.
   • If the policy is not required for this subscription or scenario:
     • Ask the subscription or management group administrator to modify or remove the policy assignment that is blocking App Service.
   • For centrally managed initiatives (for example, “Deny generally unwanted Resource Types” or “Allowed resource types”), changes typically must be made by the organization’s policy/tenant admin.
5. Retry the deployment
   • After the policy assignment is updated or removed and compliance is re-evaluated, redeploy the App Service resource. The deployment should succeed once the policy no longer denies the resource type or configuration.

If the policy is owned by an organizational admin and cannot be changed directly in an Azure for Students subscription, contact the administrator or support channel that manages policies for that subscription so they can adjust the assignment.

References:

• Resolve errors for request disallowed by policy
• Fix the "RequestDisallowedByPolicy" error
• Troubleshoot your Azure Edge Hardware Center ordering issues
• Troubleshoot common Azure deployment errors