![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(92.8, 17%, 18%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EAV%3C/text%3E%3C/svg%3E)
Azure Red Hat OpenShift
An Azure service that provides a flexible, self-service deployment of fully managed OpenShift clusters.
![](data:image/svg+xml, %3Csvg xmlns='http://www.w3.org/2000/svg' height='64' class='font-weight-bold' style='font: 600 30.11764705882353px "SegoeUI", Arial' width='64'%3E%3Ccircle fill='hsl(128, 8%, 22%)' cx='32' cy='32' r='32' /%3E%3Ctext x='50%25' y='55%25' dominant-baseline='middle' text-anchor='middle' fill='%23FFF' %3EA%3C/text%3E%3C/svg%3E)
Hello Ashi,
Thank you very much for your cooperation and for taking the time to work with us offline during the troubleshooting. We truly appreciate your patience while we coordinated with the ARO team to better understand the cause of the issue.
From the investigation, it was found that the issue is related to a subscription-level policy that is currently blocking the resource creation request. Specifically, the policy restricts Managed Identity Federated Credentials based on approved issuer types, and as a result, the request is being denied. At the moment, the issuer eastus2.oic.aro.azure.com and westus3.oic.aro.azure.com is not included in the list of allowed issuers, which is preventing the ARO cluster creation from completing successfully.
To help move forward, you may consider either using a subscription that is not governed by this policy or updating the policy to include a wildcard entry such as *.oic.aro.azure.com, if that aligns with the guidelines.