Azure Policy not enforcing Deny when creating a Subscription in a Management Group

Question

Azure Policy not enforcing Deny when creating a Subscription in a Management Group

steven varley 20

Hi,

I'm trying to use an Azure custom policy to deny creation of subscription in a management group when mandatory subscription tags are not provided. Currently creation of the subscription is allowed but then marked as non-compliant in the portal.

Can someone help me understand if policies can be used to deny creation of subscriptions in the above scenario?

Copilot advises "No, the absence of a subscription tag cannot prevent the creation of an Azure subscription. Azure Policy can mark a subscription as non-compliant if it lacks required tags, but it cannot block the creation of the subscription itself"

Is this correct?

Thanks

steven varley 20 Reputation points

2025-05-28T11:01:52.0533333+00:00

Thankyou for the confirmation Pranay.

Answer accepted by question author

0 additional answers

Your answer

steven varley 20 Reputation points

2025-05-28T11:01:52.0533333+00:00

Thankyou for the confirmation Pranay.

Answer 1

Pranay Reddy Madireddy 6,340 Moderator

Hi steven varley

Azure Policy cannot block the creation of a subscription if mandatory tags are missing. It can only mark the subscription as non-compliant if the required tags are not present, but it does not have the ability to prevent the creation of the subscription.
https://learn.microsoft.com/en-us/azure/azure-resource-manager/management/tag-policies#policy-definitions

Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and upvote it wherever the information provided helps you, this can be beneficial to other community members.it would be greatly appreciated and helpful to others.

Pranay Reddy Madireddy 6,340 Reputation points Moderator

2025-05-28T11:08:51.49+00:00

Hi steven varley

Thank you for letting us know. I will convert the comment into an answer. If you could kindly accept answer and upvote it for the benefit of the community, it would be greatly appreciated and helpful to others.
stephane clavel 66 Reputation points

2026-09-17T06:15:33.29+00:00

Hi @Pranay Reddy Madireddy

Do you mean there is no built-in azure policy to block sub creation if a tag is missing or do you mean this is not technically feasible, even with a custom azure policy please?