Azure Subscription Blocked by UnusualActivity – Escalation Request when Provisioning Ubuntu VM

The CompromisedActivity error indicates that Azure has placed a restriction on the subscription after detecting activity that its risk systems consider unusual. This restriction is generally related to account verification, identity risk signals, billing validation, or usage patterns rather than the specific VM image, VM size, or region being deployed.

A few things you can check before proceeding:

Determine whether the restriction is subscription-specific or broader

• Try creating a simple resource such as a Storage Account or Resource Group.
• If multiple resource deployments fail with the same message, the restriction is likely affecting the subscription rather than the Ubuntu image or VM configuration.

Review security and identity signals

• Check Microsoft Entra ID Risky Users and Risk Detections for any flagged accounts.
• Review Microsoft Defender for Cloud recommendations and alerts.
• Verify that there are no unexpected users, service principals, or deployments within the subscription.

Inspect recent activity and costs

• Review the Azure Activity Log around the time the restriction appeared.
• Check Cost Management for any unexpected compute usage, networking charges, or activity in regions you do not normally use.
• Unexpected deployments or sudden consumption spikes can indicate that Azure detected behaviour requiring additional validation.

Validate billing and subscription information

• Confirm that the subscription is active and associated billing information is current and verified.
• Recent subscription changes, offer conversions, or payment method updates can sometimes coincide with additional verification checks.

Collect diagnostic information

• Capture the deployment Correlation ID, the exact UTC timestamp of the failed deployment, the target region, and the VM SKU from the Activity Log.
  • These details help identify the specific operation that triggered the restriction.

Avoid repeated deployment retries

• Continuously retrying deployments across different VM sizes, images, or regions is unlikely to bypass the restriction and can make troubleshooting more difficult.
• Focus on identifying the underlying subscription issue first.

Based on your description, deploying an internal open-source IT asset management solution on a new subscription could have triggered a false positive if Azure's automated risk systems detected activity requiring further validation. The restriction is usually associated with the subscription status rather than the Ubuntu 24.04 image, the Standard B2ls_v2 SKU, or the Germany West Central region.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.

Hello @Lasal

Here's how to resolve it:

1. Submit an Azure support ticket — this is the only direct fix path
   • Go to portal.azure.com
   • Click Help + Support → Create a support request
   • Issue type: Billing
   • Problem type: Subscription management
   • Sub-problem: Reactivate a disabled subscription or Security and compliance
2. In the ticket, include:
   • Subscription ID
   • The exact error: CompromisedActivity / UnusualActivity
   • A clear business justification (you can copy/adapt this):

   "Our organization is deploying an open-source IT asset management system for internal use. This is our first VM deployment on this subscription. The activity is legitimate and expected. We request a review and removal of the CompromisedActivity flag on subscription [ID]."

If this answers your query, do click Accept Answer and Up-Vote for the same. And, if you have any further query do let us know.

Hello @Lasal

The key part of the error is CompromisedActivity. This is a subscription-level security restriction, not an issue with the Ubuntu image, VM size, or Germany West Central configuration. Similar cases show that Azure can restrict resource provisioning when it detects unusual activity.

Unfortunately, no CLI or portal configuration change can remove this restriction. The Azure Subscription/Account Review team must review it.

I recommend opening: Azure Portal → Help + support → Create a support request → Subscription management

Include the exact CompromisedActivity error, subscription ID, failed deployment timestamp/correlation ID, and explain that this is a legitimate first VM deployment. You can use the support link included directly in the error:

Azure Subscription Management Support

Also check Azure Service Health → Security advisories, as the error specifically indicates that additional information may be available there.

Don't keep retrying different VM sizes, images, or regions. Review the subscription restriction first. Once Microsoft clears the flag, retry the deployment.

Help make this community better for everyone: if this answer resolved your issue, please accept it or leave an upvote. If not, share more details in a comment so we can continue the discussion and find the right solution.