"DeploymentFailed" for az deployment group create --resource-group ...

Question

"DeploymentFailed" for az deployment group create --resource-group ...

lili zhang 190

The deployment of

"az deployment group create --resource-group rg-enterprise-networking-hubs-eastus2 --template-file networking/hub-default.bicep"

was failed with the following error:

{ "status":"Failed","error":{ "code":DeploymentFailed","target":"/subscriptions/....../resourceGroups/rg-enterprise-networking-hubs-eastus2/providers/Microsoft.Resources/deplotments/hub-default","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"ResourceDeplotmentFailure","target":"/subscriptions/....../resourceGroups/rg-enterprise-networking-hubs-eastus2/providers/Microsoft.Network/azureFirewalls/fw-eastus2-hub","message":"The resource write operation failed to complete successfully, because it reached terminal provisioning state 'Failed'.","details":[ { "code":"InternalServiceError","message":"An error occurred.","details":[]}]}]} }

Please help me out with this. Thanks.

Anonymous

2025-07-22T22:13:18.69+00:00

Hello

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.
lili zhang 190 Reputation points

2025-07-22T22:43:50.21+00:00
Hello G Sree Vidya,

I have reviewed your previous post.

My current situation is that I am trying to run the reference implementation of "aks-fafrikam-dronedelivery" from Microsoft.

About months ago I forked this project from github.com, ......, then ran this same command of "az deployment group create --resource-group rg-enterprise-networking-hubs-estus2 --template-fie networking/hub-default.bicep" smoothly without any problem, ...... until when I had to deploy aks cluster and I felt that foking the project was too sophisticated and I should have tried to just clone the project first. So I deleted the resource groups as the following:

az group delete -n rg-shipping-dronedelivery-eastus2 --no-wait

az group delete -n rg-shipping-dronedelivery-eastus2-acr --no-wait

az group delete -n rg-enterprise-networking-spokes-eastus2 --no-wait

az group delete -n rg-enterprise-hubs-eastus2 --no-wait

Then I cloned the project from github.com and redid everything until ran this mentioned command of "az deployment group create --resource-group rg-enterprise-networking-hubs-estus2 --template-fie networking/hub-default.bicep".

The hub-default.bicep is the following:

"@description('The hub's regional affinity. All resources tied to this hub will also be homed in this region. The network team maintains this approved regional list which is a subset of zones with Availability Zone support.')

param location string = resourceGroup().location

@description('A /24 to contain the firewall, management, and gateway subnet')

@minLength(10)

@maxLength(18)

param hubVnetAddressSpace string = '10.200.0.0/24'

@description('A /26 under the VNet Address Space for Azure Firewall')

@minLength(10)

@maxLength(18)

param azureFirewallSubnetAddressSpace string = '10.200.0.0/26'

@description('A /27 under the VNet Address Space for our On-Prem Gateway')

@minLength(10)

@maxLength(18)

param azureGatewaySubnetAddressSpace string = '10.200.0.64/27'

@description('A /27 under the VNet Address Space for Azure Bastion')

@minLength(10)

@maxLength(18)

param azureBastionSubnetAddressSpace string = '10.200.0.96/27'

var defaultFwPipName = 'pip-fw-${location}-default'

var hubFwName = 'fw-${location}-hub'

var hubVNetName = 'vnet-${location}-hub'

var hubLaName = 'la-networking-hub-${location}-${uniqueString(hubVnet.id)}'

resource hubVnet 'Microsoft.Network/virtualNetworks@2023-04-01' = {

name: hubVNetName

location: location

properties: {

addressSpace: { addressPrefixes: [ hubVnetAddressSpace ] } subnets: [ { name: 'AzureFirewallSubnet' properties: { addressPrefix: azureFirewallSubnetAddressSpace serviceEndpoints: [ { service: 'Microsoft.KeyVault' } ] } } { name: 'GatewaySubnet' properties: { addressPrefix: azureGatewaySubnetAddressSpace serviceEndpoints: [] } } { name: 'AzureBastionSubnet' properties: { addressPrefix: azureBastionSubnetAddressSpace serviceEndpoints: [] } } ] enableDdosProtection: false enableVmProtection: false

}

}

resource defaultFwPip 'Microsoft.Network/publicIpAddresses@2023-04-01' = {

name: defaultFwPipName

location: location

zones: [

'1' '2' '3'

]

sku: {

name: 'Standard'

}

properties: {

publicIPAllocationMethod: 'Static' idleTimeoutInMinutes: 4 publicIPAddressVersion: 'IPv4'

}

}

resource hubFw 'Microsoft.Network/azureFirewalls@2023-04-01' = {

name: hubFwName

location: location

zones: [

'1' '2' '3'

]

properties: {

sku: { name: 'AZFW_VNet' tier: 'Standard' } threatIntelMode: 'Alert' ipConfigurations: [ { name: defaultFwPipName properties: { subnet: { id: resourceId('Microsoft.Network/virtualNetworks/subnets', hubVnet.name, 'AzureFirewallSubnet') } publicIPAddress: { id: defaultFwPip.id } } } ] natRuleCollections: [] networkRuleCollections: [ { name: 'org-wide-allowed' properties: { action: { type: 'Allow' } priority: 100 rules: [ { name: 'dns' sourceAddresses: [ '*' ] protocols: [ 'UDP' ] destinationAddresses: [ '*' ] destinationPorts: [ '53' ] } { name: 'ntp' description: 'Network Time Protocol (NTP) time synchronization' sourceAddresses: [ '*' ] protocols: [ 'UDP' ] destinationPorts: [ '123' ] destinationAddresses: [ '*' ] } ] } } ] applicationRuleCollections: []

}

}

resource hubLa 'Microsoft.OperationalInsights/workspaces@2022-10-01' = {

name: hubLaName

location: location

properties: {

sku: { name: 'PerGB2018' } retentionInDays: 30

}

}

resource hubFwMicrosoftInsightsDefault 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {

scope: hubFw

name: 'default'

properties: {

workspaceId: hubLa.id logs: [ { category: 'AzureFirewallApplicationRule' enabled: true } { category: 'AzureFirewallNetworkRule' enabled: true } ] metrics: [ { category: 'AllMetrics' enabled: true } ]

}

}

resource hubVnetMicrosoftInsightsDefault 'Microsoft.Insights/diagnosticSettings@2021-05-01-preview' = {

name: 'default'

scope: hubVnet

properties: {

workspaceId: hubLa.id metrics: [ { category: 'AllMetrics' enabled: true } ]

}

}

output hubVnetId string = hubVnet.id

"

Thanks for the help!
Anonymous

2025-07-23T19:04:41.13+00:00

Hello lili zhang

Thank you for your update.

Could you please try deploying in a different region example: easts instead of eastus2 as likely there is a resource from previous deployment causing some issues.

To help you further, we have started the private message. Could you please check it and confirm?
Anonymous

2025-07-24T20:39:22.98+00:00

Hi lili zhang

Thank you for your confirmation that the issue is resolved after changing the region.

Please let us know do you have any further queries.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

1 answer

Your answer

Anonymous

2025-07-22T22:13:18.69+00:00

Hello

We haven't heard back from you regarding our last response and wanted to check if you had the opportunity to review our previous post.

Please let us know if you have any questions or concerns. We are happy to assist you.
Anonymous

2025-07-23T19:04:41.13+00:00

Hello lili zhang

Thank you for your update.

Could you please try deploying in a different region example: easts instead of eastus2 as likely there is a resource from previous deployment causing some issues.

To help you further, we have started the private message. Could you please check it and confirm?
Anonymous

2025-07-24T20:39:22.98+00:00

Hi lili zhang

Thank you for your confirmation that the issue is resolved after changing the region.

Please let us know do you have any further queries.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

Answer 1

Hello lili zhang

We understood that y you're running into a "DeploymentFailed" error while using the az deployment group create command. This typically happens when an underlying resource fails during the provisioning as per error it is the deployment failed due to an issue with the Azure Firewall resource (fw-eastus2-hub) reaching a terminal provisioning state 'Failed'.

We request you to please check below details to resolve the issue

1.Since the error is related to the Azure Firewall, check its provisioning state and error details:

az resource show --resource-group rg-enterprise-networking-hubs-eastus2 --name fw-eastus2-hub --resource-type "Microsoft.Network/azureFirewalls"

2.The firewall must be deployed in a subnet named AzureFirewallSubnet with a minimum /26 address space.

Route Conflicts: Conflicting UDRs (User Defined Routes) can cause provisioning to fail.
Missing Dependencies: Ensure all required resources (e.g., public IPs, route tables) are correctly defined and available.

3.Make sure that the parameters and configurations used in your Bicep template for the Azure Firewall are correct. Check for any dependencies or required fields that might be missing.

4.We suggest you review the azure deployment error troubleshoot document:

https://github.com/MicrosoftDocs/azure-docs/blob/main/articles/azure-resource-manager/troubleshooting/common-deployment-errors.md

Since InternalServiceError can be caused by transient issues (e.g., Azure service disruptions), retry the deployment after a short wait:

Additionally, we have suggested to deploy in a different region example: easts instead of eastus2 as likely there is a resource from previous deployment causing some issues.

Hope the above answer helps! Please let us know do you have any further queries.

If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!

User's image

Share via

"DeploymentFailed" for az deployment group create --resource-group ...

1 answer

Your answer