Skip to main content

Failed to Add Azure Subscription: RequestDisallowedByPolicy for Key Vault Deletion Protection

Failed to Add Azure Subscription: RequestDisallowedByPolicy for Key Vault Deletion Protection

Problem description

During the final step of registering or adding Azure subscriptions in the Druva Cloud Platform (DCP) console, the operation fails while saving the encryption key or creating resources. The registration wizard terminates with an error stating that resource creation was disallowed by Azure policy.

Cause

Your organisation has an Azure Policy assigned at the Management Group or Subscription level—specifically the policy definition "Key vaults should have deletion protection enabled". When Druva automatically provisions Azure Key Vaults to manage customer-managed data encryption during onboarding, the Azure Policy engine intercepts the resource creation request. Because the policy enforcement effect is set to Deny, the deployment is blocked because purge/deletion protection is not explicitly enabled during the initial provisioning call.

Traceback

The Druva console displays the following on-screen error:

Error: RequestDisallowedByPolicy: [Vault Name] was disallowed by Key vaults should have deletion protection enabled

(Example Key Vault names: abcd-efg-12345-678, hijk-lmn-90123-456)

In the browser network trace (HAR.log) or API response payload:

{   "code": "ConnectionSvc-1001",   "message": "Codes:[RequestDisallowedByPolicy], Msg:Resource '<Vault-Name>' was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Enforce recommended guardrails for Azure Key Vault\",\"id\":\"/providers/Microsoft.Management/managementGroups/.../providers/Microsoft.Authorization/policyAssignments/...\"},\"policyDefinition\":{\"name\":\"Key vaults should have deletion protection enabled\",\"id\":\"/providers/Microsoft.Authorization/policyDefinitions/0b60c0b2-2dc2-4e1c-b5c9-abbed971de53\"}}]'." }

Resolution

Request your Azure Security or Cloud Administrator to implement either of the following solutions:

Option A: Exclude the Druva Scope from the Policy Assignment (Recommended)

  1. Sign in to the Azure Portal.

  2. Navigate to Policy > Assignments.

  3. Locate the policy assignment for "Key vaults should have deletion protection enabled".

  4. Edit the assignment and select the Exclusions tab.

  5. Add an exclusion for either:

    • The specific Target Subscription(s) being registered in Druva.

    • The specific Resource Group(s) where Druva deploys the Key Vaults.

  6. Click Review + Save to apply the exclusion.

Option B: Temporarily Change the Policy Effect

  1. Sign in to the Azure Portal, navigate to Policy > Assignments, and select the policy assignment.

  2. Edit the assignment parameters and change the Effect from Deny to Audit (or DeployIfNotExists).

  3. Click Review + Save to permit resource creation during onboarding.

  4. Once onboarding completes successfully, revert the policy effect back to Deny if required by internal security governance.

Verification

  1. Allow 5 to 15 minutes for Azure Policy changes to propagate across your tenant.

  2. Return to the Druva Cloud Platform console.

  3. Re-attempt saving the Encryption Key and complete Azure subscription registration.

  4. Verify that the Key Vault is provisioned without RequestDisallowedByPolicy errors and the subscription displays as configured in the Druva console.

See also

Did this answer your question?

Related Articles