Azure Subscription Disabled Due to Alleged Suspicious Activity #2607270040008564

Question

Azure Subscription Disabled Due to Alleged Suspicious Activity #2607270040008564

Raparla Chalvas 0

Hello Azure Support Team,

My Azure subscription has been disabled following a routine audit. I received the following notification:

"We identified suspicious activity in your subscription that violates the Microsoft Acceptable Use Policy. We've disabled your subscription until the issue can be resolved."

I believe this may be an error and would like assistance understanding:

What specific activity triggered the suspension?

How can I review and remediate the issue?

What steps are required to have the subscription re-enabled?

Is there any additional information or verification needed from my side?

Currently, I am unable to access the subscription resources and would appreciate guidance on the next steps.
Thank you for your assistance.

Best regards,
Raparla

0 comments

2 answers

Your answer

Answer 1

Hello,

Thank you for providing the support request number 2607270040008564.

Since a support request is already open, the case is with the appropriate Microsoft team for review. For subscriptions that are disabled due to suspected suspicious activity or potential Acceptable Use Policy concerns, the specific reason for the suspension is reviewed internally and cannot typically be determined through Microsoft Q&A

At this stage, the best course of action is to continue working through the existing support request, as the support team handling the case has access to the required subscription details and internal investigation tools. Subscription reactivation for these scenarios requires review by Microsoft support and cannot be completed through a self-service process.

If you have not received an update recently, you may reply to the latest communication associated with support request 2607270040008564 to request a status update. The assigned team will provide guidance on any verification or remediation steps that may be required.

Thank you for your patience and cooperation throughout the review process.

Answer 2

For a subscription disabled for suspicious activity or an acceptable use policy concern, the next step is to create a Subscription management support request and ask for the subscription to be reviewed and re-enabled. The review is handled by the security team.

Supported guidance:

In the Azure portal, open Help + support and select Create a support request.
Search for re-enable subscription.
Select Subscription management.
Select the affected subscription.
If suggested articles appear, continue with Create a support request rather than stopping on the recommendations.
Use:
- Problem type: Re-enable my subscription
- Problem subtype: Could not reactivate by self-service
Complete the remaining details and submit the request.

What can be answered from the available guidance:

What specific activity triggered the suspension?
The available guidance only states that Azure can disable a subscription when suspicious activity or acceptable use policy violations are detected. It does not provide the exact triggering event in an individual case.
How can the issue be reviewed and remediated?
Review sign-in activity and subscription activity for unauthorized actions:
- Check Microsoft Entra sign-in logs for unusual sign-in patterns.
- Check the Azure Activity Log for unauthorized billing, usage, or configuration changes.
- Review spending anomalies in Azure Cost Management.
- If compromised resources are found, disable or delete them and clean up the environment.
What is required to have the subscription re-enabled?
Submit the support request above so the security team can review the case and re-enable the subscription if appropriate.
Is additional information needed from the subscription owner?
The guidance supports providing the required details in the support request. If the security team needs more verification or information, that is handled through the support case.

If the support flow loops back to recommended articles, use Return to support request and continue the case creation flow instead of selecting the suggested solutions.