azd up fails - "715-123420 unusual activity" on Microsoft.CognitiveServices/accounts preflight

Question

azd up fails - "715-123420 unusual activity" on Microsoft.CognitiveServices/accounts preflight

Alessia Saggio 0

Hello all,

I'm deploying an Azure AI Foundry template (Microsoft's mslearn-genaiops azd template) and every provision fails at preflight validation.

Error:

InvalidTemplateDeployment — Microsoft.CognitiveServices/accounts (2025-06-01) reported preflight validation errors:

715-123420: "Our system has detected this request as unusual activity for your account. If you are confident this is in error, please contact support."

What happens:

The resource group and base resources (Log Analytics, App Insights) provision fine.
It consistently fails when creating the CognitiveServices / Foundry account.
Same error from azd up, azd provision, and azd provision --preview.
The error occurs at PREFLIGHT, before any account or model deployment is actually created.

What I've already ruled out:

Not quota: az cognitiveservices usage list shows current usage at 0 against non-zero limits.
Not SKU/region availability: az cognitiveservices account list-skus --kind AIServices shows S0 is available in my region.
Not a transient conflict: the block has persisted 18+ hours across many attempts and changing deployment names.
Not a template bug: it's an unmodified official Microsoft azd template, and the base resources deploy successfully.

This looks like an account-level anti-abuse / "unusual activity" flag rather than a configuration or quota problem. I'm attending the AI-300 course and I suspect this is arising from spinning-up and deleting resources quite frequently from following the exercises. But of course just a hypothesis.

Questions:

Has anyone had this 715-123420 "unusual activity" flag on a personal subscription, and how did you get it removed?
Is contacting support the only way to clear it, or is there a self-service unblock (e.g. identity verification, adding a payment method, subscription upgrade)?
How long did it take to be lifted once reported?

Thanks in advance.

Manish Deshpande 8,220 Reputation points Microsoft External Staff Moderator

2026-10-15T12:26:04.79+00:00

Hello @Alessia Saggio

We are aware of this issue and are actively working on it. We kindly request your patience while our team continues to investigate and work toward a resolution. We will share updates as soon as they become available. Thank you for your understanding.

Requested few details over the private message pls provide the details at your earliest.

Thank you!

2 answers

Your answer

Manish Deshpande 8,220 Reputation points Microsoft External Staff Moderator

2026-10-15T12:26:04.79+00:00

Hello @Alessia Saggio

We are aware of this issue and are actively working on it. We kindly request your patience while our team continues to investigate and work toward a resolution. We will share updates as soon as they become available. Thank you for your understanding.

Requested few details over the private message pls provide the details at your earliest.

Thank you!

Answer 1

Alessia Saggio 0

Thanks for your reply @Senthil kumar ,

Was hoping there was a faster solution to this, but alas. I contacted support.

0 comments

Answer 2

Hi @Alessia Saggio

1. Has anyone seen this and how was it removed? Yes. Multiple users have reported the 715-123420 error. Microsoft moderators indicate that the flag is applied at the subscription/account level and generally requires investigation by Microsoft's internal fraud/security team. Users reported working through Microsoft Support rather than resolving it through resource configuration changes.

2. Is there a self-service unblock? I found Microsoft guidance stating that this type of block requires review by the appropriate internal team and that users should contact support for investigation/escalation. The sources do not mention a self-service method such as identity verification, adding a payment method, upgrading the subscription, or changing settings to clear the flag.

3. How long does it take to be lifted? I could not find an official timeframe in the sources. Microsoft Q&A responses indicate that the case must be reviewed by internal teams, but they do not provide a guaranteed duration for removal of the flag.

Practical takeaway:

Recreating resources, changing regions, or repeatedly retrying deployments is generally not reported as a fix.
Open a support request and provide the subscription ID, tenant ID, affected resource details, and the exact error code (715-123420). Microsoft moderators consistently direct users toward support/internal review.

Thanks.