Azure subscription disable

Question

I have received an email that my Azure subscription has been disabled. The was a message in the body - "we identified suspicious activity in your subscription that violates the Microsoft Acceptable Use Policy. We’ve disabled your subscription until the issue can be resolved.". How to identify the problem?

Answer 1

I think the email alone isn't enough to identify the specific violation. Activity Log can show resource changes, but it doesn't cover all activity within a resource. Open an Azure support request for the disabled subscription, attach the email, and ask which activity or resource was involved, when it occurred, and what needs fixing. If u believe the suspension was a mistake, request a review.

addtional info

https://learn.microsoft.com/en-us/azure/azure-monitor/fundamentals/activity-log 　　←Activity Log

https://learn.microsoft.com/en-us/azure/azure-portal/supportability/how-to-create-azure-support-request　

←Azure support request

Answer 2

To identify the problem, review the subscription and account for signs of compromise, then open an Azure support request for the subscription review.

Recommended steps:

1. Review Microsoft Entra sign-in activity Check for unusual sign-ins around the time the alert was triggered:
   • IP addresses
   • Sign-in locations
   • Sign-in times
   • Sign-in success or failure
2. Review Azure activity in the subscription Check the Azure Activity Log for unauthorized changes, unusual configuration updates, or unexpected usage.
3. Review spending anomalies Check Azure Cost Management for unexpected consumption or budget anomalies.
4. Check for compromised identities Immediately change credentials for tenant admins and users with RBAC access on Azure subscriptions, verify password recovery details, and ensure MFA is registered and enforced for tenant admins and RBAC owners.
5. If the activity is not legitimate, clean up compromised resources Disable or delete resources created by an unauthorized party. This can be destructive, so verify ownership before removing anything.
6. Contact Azure Support If the subscription was disabled for suspicious activity or an acceptable use policy violation, the supported path is to create a support request with Azure Support. Community guidance specifically points to:
   • Help + support in the Azure portal
   • Create a support request
   • Issue type: Subscription management
   • Problem type: Re-enable my subscription

This combination of sign-in logs, Azure Activity Log, cost review, and support request is the documented path to identify suspicious activity and get the subscription reviewed.

---

• Detect and respond to security alerts
• Respond to a compromised cloud email account
• Disabled subscription for suspicious activity - Stopped VM - Microsoft Q&A
• Subscription blocked - Microsoft Q&A
• I received an email titled: Your Azure Subscription Has Been Disabled - Microsoft Q&A