Azure Functions Flex Consumption blocked by ServerFarmCreationNotAllowed (Forbidden 70001)

Treat this as a failed creation of the underlying Microsoft.Web/serverfarms resource, but do not assume that ExtendedCode 70001 alone proves a specific backend restriction; verify region/runtime eligibility, deployment RBAC, and policy evidence, then request Microsoft investigation without provisioning more resources.

1. Run read-only eligibility checks

These commands create nothing and incur no resource charges. Use Azure CLI 2.60.0 or later for Flex Consumption management.^1^

az login

# Is Southeast Asia currently offered for Flex Consumption?
az functionapp list-flexconsumption-locations \
  --query "sort_by(@, &name)[].{Region:name}" -o table

# Which Python versions are offered there?
az functionapp list-flexconsumption-runtimes \
  --location southeastasia \
  --runtime python \
  --query '[].{version:version}' -o table

Interpret the results:

• If southeastasia is absent, do not retry there. The portal also excludes unsupported Flex regions.^1^
• If Python 3.14 is absent for that region, select a version returned by the command or another supported region. Python 3.14 is generally supported by Azure Functions and listed for Flex Consumption, but regional availability should still be checked.^2^
• If both are returned, the region and runtime are currently advertised as supported; subscription- or offer-specific eligibility can still require Support confirmation.

2. Check the two remaining customer-visible causes

Since provider registration, subscription status, deployment history, and Activity Logs are already checked, do not repeat them.

Deployment RBAC: insufficient permissions are a documented possible cause of this message. If the deployment identity is not Owner or Contributor on the target resource group or subscription, ask an administrator to grant suitable deployment access and retry once.^3^

If it already has Owner or Contributor, this common branch is ruled out and a subscription/platform-side restriction becomes more likely.

Azure Policy: inspect the failed Activity Log event for policy assignment and definition IDs. A genuine Azure Policy Deny normally includes those IDs in the error or Activity Log.^4^

• If IDs appear, go to Azure portal → Policy → Assignments/Compliance, identify the owner, and request an exemption or policy correction.
• If no IDs appear, that is strong evidence against this being an ordinary Azure Policy deny, although it does not rule out every governance mechanism.

The normal Flex regional compute quota is unlikely to explain creation being categorically forbidden: Microsoft documents that exhausting this quota can delay or fail execution/deployment and throttle scaling, but still permits creation of new apps.^2^

3. Escalate for subscription-side investigation

Closely matching Flex/Consumption cases with the same serverfarm message were resolved only after an internal team applied a fix to the affected subscription.^5^ Another case identified an internal built-in security block and likewise required a Microsoft-side fix.^6^

In Azure portal → Help + Support → Create a support request:

1. Select the affected subscription and the closest Technical → Azure Functions/App Service → deployment or creation failure classification.
2. On Recommended solution, do not select another article. Select Return to support request, then Next.
3. Select the available support plan/method and submit.^7^
4. Include:
   • Microsoft.Web/serverfarms/write
   • ServerFarmCreationNotAllowed, Forbidden, ExtendedCode 70001
   • Southeast Asia, Flex Consumption, Python 3.14
   • exact UTC timestamp from each Activity Log event
   • correlation/request IDs
   • confirmation that both read-only CLI checks returned Southeast Asia and Python 3.14, if they did
   • request: “Please check for a subscription/offer or internal security restriction on Microsoft.Web serverfarm creation and enable it if appropriate.”

Do not post subscription IDs or correlation IDs publicly; provide them only through the ticket’s private details or engineer follow-up.

The account opening the request needs Owner, Contributor, or Support Request Contributor at subscription scope, or a custom role containing Microsoft.Support/*.^7^ This support-ticket RBAC requirement is separate from deployment RBAC.

If the portal routes the technical issue to Microsoft Q&A, that may be the expected Priority Community Support experience for eligible plans/issues. A support ticket remains linked to the Q&A thread, and an engineer can move sensitive investigation to private Q&A or email.^8^

If submission still cannot be completed, ask the subscription owner or support-agreement administrator to verify:

• subscription-level Support Request Contributor access;
• that the support entitlement is linked and available to the signed-in account.

This is the documented fallback when expected support access is unavailable.^9^

Avoid creating paid plans or repeatedly retrying deployments. One later retry is sufficient after Support confirms that any restriction has been removed.

References

1. Create and Manage Function Apps in a Flex Consumption Plan
2. Azure Functions Flex Consumption plan hosting | Microsoft Learn
3. Always get "The subscription 'xxxxxxxxxxxxxxxxxxxxxxxx' is not allowed to create or update the serverfarm." when creating function app - Microsoft Q&A
4. Troubleshoot errors with using Azure Policy
5. Azure Function App deployment fails with ServerFarmCreationNotAllowed) - Microsoft Q&A
6. I am unable to deploy any Function App (Consumption or Flex Consumption) because the subscription returns: ServerFarmCreationNotAllowed Please enable App Service Plan creation for this subscription. I need to run Azure Function Apps for API endpoints and - Microsoft Q&A
7. Create an Azure support request
8. Get Azure help through Priority Community Support (PCS)
9. Microsoft Cloud Portals: Self-Help When a Support Request Cannot Be Opened