Deployment failed with RequestDisallowedByPolicy: finding and handling the Azure Policy

#The error

Code: RequestDisallowedByPolicy
Message: Resource 'stdata01' was disallowed by policy. Policy identifiers:
'[{"policyAssignment":{"name":"Deny public storage","id":"/providers/Microsoft.Management/managementGroups/corp/providers/Microsoft.Authorization/policyAssignments/deny-pub-st"},
"policyDefinition":{"name":"Storage accounts should disable public network access", ...}}]'

The message already contains the assignment ID and definition name. Read those first.

#Look at the rule

az policy assignment show --ids "/providers/Microsoft.Management/managementGroups/corp/providers/Microsoft.Authorization/policyAssignments/deny-pub-st" \
  --query "{name:displayName, def:policyDefinitionId, params:parameters, enforcement:enforcementMode}"

az policy definition show --name <definition-guid-or-name> --query "policyRule" -o json

The if block tells you exactly which property values are denied. The fix is usually one setting in your template, for example:

resource st 'Microsoft.Storage/storageAccounts@2023-05-01' = {
  name: 'stdata01'
  location: location
  sku: { name: 'Standard_ZRS' }
  kind: 'StorageV2'
  properties: {
    publicNetworkAccess: 'Disabled'
    minimumTlsVersion: 'TLS1_2'
    allowBlobPublicAccess: false
  }
}

#Test before you deploy

az deployment group what-if -g rg-data --template-file main.bicep

what-if doesn't always surface policy denials. For a pre-check, use the policy restrictions API that the portal uses, or deploy to a dev subscription that has the same assignments.

#Compliance view

az policy state list --resource-group rg-data --filter "complianceState eq 'NonCompliant'" \
  --query "[].{resource:resourceId, policy:policyDefinitionName}" -o table

#When the policy is right but you need an exception

Request a policy exemption scoped as narrowly as possible, with an expiry date:

az policy exemption create -n legacy-vendor-st \
  --policy-assignment "/providers/Microsoft.Management/managementGroups/corp/providers/Microsoft.Authorization/policyAssignments/deny-pub-st" \
  --exemption-category Waiver --scope "/subscriptions/<sub>/resourceGroups/rg-vendor/providers/Microsoft.Storage/storageAccounts/stvendor01" \
  --expires-on 2027-01-31 --description "Vendor tool needs public endpoint until migration (CHG-12345)"

Important

Exemptions need Microsoft.Authorization/policyExemptions/write at that scope, usually held by the platform or security team. Bring the business reason and an end date.

#Effects worth knowing