Azure for Students blocked by system-protected [UNUSUALACTIVITY] Full Deny Assignment, and I cannot create a support request

Alisher Tilektes 20 Reputation points
2026-09-25T09:38:56.5133333+00:00

Hello, My Azure for Students subscription is Active and my account has the Owner role, but I cannot deploy any Azure resources. When I try to create a Resource Group, the operation fails with: DenyAssignmentAuthorizationFailed The error states that access is denied because of a system-protected deny assignment: [UnusualActivity] Full Deny Assignment The deny assignment is applied at the root scope (/). Blocked operation: Microsoft.Resources/subscriptions/resourceGroups/write I attempted to create a Subscription Management support request, but Azure Support refuses to create the request and says that the subscription may be disabled. However, my Azure for Students subscription is shown as Active in the Azure Portal. I need assistance from Microsoft to review this system-protected deny assignment and restore the ability to deploy resources. I can provide the Subscription ID, Tenant ID and Deny Assignment ID privately if required. Thank you.

Azure Role-based access control
Azure Role-based access control

An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.

0 comments
Answer accepted by question author
Taz 10,126 Reputation points MVP Volunteer Moderator
2026-09-25T14:06:20.19+00:00

Hi Alisher,

This is a root-level system-protected deny assignment, so your Owner role cannot override it. Microsoft confirms that deny assignments take precedence over RBAC permissions and are managed by Azure.

The [UnusualActivity] Full Deny Assignment pattern has also been reported for Azure for Students subscriptions, where all resource creation operations are blocked. In those cases, Microsoft moderators have directed users to Azure Support for investigation.

Since your subscription shows Active but Support is rejecting the request because it thinks the subscription is restricted, this needs to be handled by Microsoft. Provide the subscription ID, deny assignment ID, correlation ID, and the exact DenyAssignmentAuthorizationFailed error and ask the support team to review and clear the UnusualActivity restriction.

Do not try to remove the deny assignment yourself. A system-protected assignment at / is not a normal RBAC assignment.

Was this answer helpful?

1 person found this answer helpful.

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.