Problem description
This article provides steps to troubleshoot and resolve issues when onboarding Azure subscriptions, particularly when encountering the "DisallowedByPolicy" error.
Traceback
retry=false escape=true code=ConnectionSvc-1001 message="Codes:[RequestDisallowedByPolicy], Msg:Resource 'putphx-drv-xxx-xxx was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Allowed locations\",\"id\":\"/subscriptions/42f9388b-xxxx-xxxx-xxxx-8b75e03a02c9/providers/Microsoft.Authorization/policyAssignments/xxx73cc9159842cd8fxxxx\"},\"policyDefinition\":{\"name\":\"Allowed locations\",\"id\":\"/providers/Microsoft.Authorization/policyDefinitions/xxxxxxx-4747-49cd-b67b-bf8b01975xxx\"}}]'
Resolution
Prerequisites:
Ensure all prerequisites for Azure onboarding are met.
Steps to Resolve:
Onboarding Process:
Create a resource group and key vaults in the desired region using the dropdown button.
Select the appropriate region for onboarding.
If Onboarding Fails:
Collect HAR logs after reproducing the issue.
Analyze the HAR logs for any "DisallowedByPolicy" errors.
Identifying Policy Restrictions: If you see an error message similar to
retry=false escape=true code=ConnectionSvc-1001 message="Codes:[RequestDisallowedByPolicy], Msg:Resource 'putphx-drv-xxx-xxx was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Allowed locations\",\"id\":\"/subscriptions/42f9388b-xxxx-xxxx-xxxx-8b75e03a02c9/providers/Microsoft.Authorization/policyAssignments/xxx73cc9159842cd8fxxxx\"},\"policyDefinition\":{\"name\":\"Allowed locations\",\"id\":\"/providers/Microsoft.Authorization/policyDefinitions/xxxxxxx-4747-49cd-b67b-bf8b01975xxx\"}}]'This indicates a deny policy is set for the specific region.
Checking Azure Policies:
Log in to the Azure portal.
Navigate to Home -> Policy | Definitions.
Locate and select "Allowed locations" under Policy assignments.
Updating Allowed Locations:
In the "Allowed locations" policy, find the "listofAllowedLocations" section.
Under the "Parameter value" column, add the region where you want to create the resource group and key vault.
Retry Configuration: After updating the allowed locations, attempt to configure the Azure subscription again.