I am trying to create resource group from microsoft student account

Question

I am trying to create resource group but I'm getting below error

{"code":"DenyAssignmentAuthorizationFailed","message":"The client Removed PII@kiet.edu' with object id 'e8297e73-5d5a-4fe9-9d24-ea5b449a4ba3' has permission to perform action 'Microsoft.Resources/subscriptions/resourceGroups/write' on scope '/subscriptions/Removed PII/resourceGroups/xyz_n'; however, the access is denied because of the deny assignment with name '[UNUSUALACTIVITY] FULL DENY ASSIGNMENT ON / FOR ALL USERS ADDED' and Id '4d32aa21e2144c20ad72d58dd5edeacf' at scope '/'."}

Is anyone faced same issue

Answer 1

Hello ,

The error you’re encountering:

{
  "code": "DenyAssignmentAuthorizationFailed",
  "message": "The client '******@kiet.edu' ... access is denied because of the deny assignment '[UNUSUALACTIVITY] FULL DENY ASSIGNMENT ON / FOR ALL USERS ADDED'"
}

indicates that a Deny Assignment is applied at the root scope of your subscription. Deny assignments override all RBAC permissions, so even if your role allows resource group creation, this block will prevent it. In your case, it seems triggered by unusual activity protection in Azure for Students subscriptions.

Recommended Actions / Workarounds:

1. Verify subscription status: Ensure your Azure for Students subscription is active.
2. Check Deny Assignments:
   • Go to Subscriptions → [Your Subscription] → Access Control (IAM) → Deny Assignments
   • Look for the deny assignment named [UNUSUALACTIVITY] FULL DENY ASSIGNMENT.
   • Note: This type of deny assignment cannot be removed by you.
3. Temporary workaround: If urgent, you could create a new Azure for Students subscription, though contacting support is the official resolution.

References:

• Deny assignments in Azure
• Azure for Students FAQ
• Troubleshoot role and permission issues

Hope this helps! Thank you!

Answer 2

Hi,

Something triggered unusual activity detection and as a result Deny assignment was automatically applied. Azure support needs to remove the block.

Please create a subscription management support request so you can discuss with engineer and have them investigate and clear the block. Subscription support is free.

Please carefully follow my instructions below to create support request and avoid getting stuck in endless loop. Please let me know if you run into any issues.

1. Navigate to this link to start the process:

https://portal.azure.com/#create/Microsoft.Support

2. Enter re-enable subscription in the box and click Go

3. Select Subscription management and click Next

4. Select your subscription from the dropdown and click Next

5. At this point there will be a delay of several seconds, and then various options will be displayed. Click Create a support request button at the top. DO NOT CLICK any of the other options.

6. Fill out screen, Summary, Problem type: Re-enable my subscription, Problem subtype: Could not reactivate by self-service, then click Next button at bottom.

7. There will be another several second delay, and then some solutions will be displayed (this is similar to above). DO NOT CLICK any of the solutions, instead click on Return to support request button in upper left corner, similar to below

8. Now you are back at support case. Click Next button at bottom to continue to Additional details tab. Fill out information as required. Click Next to advance to Review + create tab, then click Create.

You should receive an automated email within a few minutes and then be contacted by support within 1 business day.

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP