Not able to create the resource group under free subscription

Question

Not able to create the resource group under free subscription

Tirupathi Gangi Reddy 0

My new Azure Free Account subscription is Active and I am the Owner. However, it is assigned to the “New Subscriptions” management group with the “Allowed resource types - NONE” policy, which prevents me from creating any resources. Please review and move my valid subscription to the appropriate management group.

kagiyama yutaka 5,330 Reputation points

2026-09-06T02:12:33.4866667+00:00

I can see the policy is blocking all resource creation. To check whether the subscription can be moved out of that management group, could you add whether your Owner role is directly assigned on the subscription and whether you have write access on the management group? Inherited Owner doesn’t include the permissions required for moving a subscription, so this point decides if the move is possible.

2 answers

Your answer

kagiyama yutaka 5,330 Reputation points

2026-09-06T02:12:33.4866667+00:00

I can see the policy is blocking all resource creation. To check whether the subscription can be moved out of that management group, could you add whether your Owner role is directly assigned on the subscription and whether you have write access on the management group? Inherited Owner doesn’t include the permissions required for moving a subscription, so this point decides if the move is possible.

Answer 1

Hello @Tirupathi Gangi Reddy

Thank you for reaching out to Microsoft Q&A.

Your subscription is Active and you are the Owner, but it landed under the “New Subscriptions” management group. That management group has an Azure Policy assignment (“Allowed resource types”) set to allow nothing, so every resource-creation attempt is denied. The policy is inherited, so even as Owner you can’t override it while the subscription stays there.

Recommended fix:

Move the subscription to a different management group that does not carry the restrictive policy (for example a Landing Zone, Sandbox, or any other group your tenant uses for normal workloads). Once the move completes, the blocking policy no longer applies and you can create resources normally.

How to move it (Portal)

Go to Management groups in the Azure portal.
Open the current parent (“New Subscriptions”).
Click the ellipsis (…) next to your subscription → Move.
Select the new parent management group and save.

Alternatively, open the target management group and use Add subscription.

Permissions needed You (or a Global Administrator / Hierarchy Settings Administrator) need write permissions on the subscription and on both the source and target management groups. Owner on the subscription is usually enough if you also have rights on the target group. If the Owner role is only inherited from the current management group, the move is limited to groups where you also hold Owner.

PowerShell / CLI equivalents are available if you prefer:

New-AzManagementGroupSubscription -GroupId '<TargetMG-Id>' -SubscriptionId '<Your-Sub-Id>'

az account management-group subscription add --name '<TargetMG-Id>' --subscription '<Your-Sub-Id>'

After the move, give it a few minutes (sometimes up to 30) for the hierarchy and policy evaluation to refresh, then try creating a resource group again.

Official Microsoft documentation that covers exactly this scenario:

Moving subscriptions between management groups https://learn.microsoft.com/en-us/azure/governance/management-groups/manage#move-management-groups-and-subscriptions
Management groups overview (inheritance and root behavior) https://learn.microsoft.com/en-us/azure/governance/management-groups/overview
Setting a default management group for new subscriptions (why new subs often land in a restrictive group) https://learn.microsoft.com/en-us/azure/governance/management-groups/how-to/protect-resource-hierarchy
Allowed / Not allowed resource types policies https://learn.microsoft.com/en-us/azure/governance/policy/tutorials/disallowed-resources

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Answer 2

kagiyama yutaka 5,330

I think the thing I wrote earlier in my comment is what decides this — Azure only lets a subscription move when Owner or Contributor is directly assigned on the subscription and you have write on the target MG. if your Owner is inherited from the current MG, that permission is not included, so a tenant admin has to give you a direct role or move it instead.

0 comments