Problem Description

During the Azure subscription registration or onboarding process in Druva Enterprise Workload, the registration process fails. The operation produces an AuthorizationFailed error during initial role creation, followed by a RequestDisallowedByPolicy error during resource deployment.

Cause

The issue is caused by a combination of insufficient user privileges and active Azure Policy enforcement:

Insufficient Permissions: The account initiating the registration lacks permissions (Microsoft.Authorization/roleDefinitions/write) to assign or write custom role definitions.
Azure Policy Enforcement: An Azure Policy (e.g., "Allowed locations" / assignment "Limit allowed locations for Resources") is enforced at the Management Group, Subscription, or Resource Group level, blocking resource creation in non-permitted regions.

Traceback

Initial Error (RBAC Permission Failure):

AuthorizationFailed: The client 'xxxx@xxxxx.com' does not have authorization to perform action 'Microsoft.Authorization/roleDefinitions/write'

HAR / API Log Traceback (Policy Disallowed):

{   "code": "ConnectionSvc-1048",   "message": "RequestDisallowedByPolicy: Resource 'sdcp-drv-1234-96' was disallowed by policy. Reasons: 'This resource must be compliant with the assigned policy.'." }

Policy Metadata:

policyDefinitionDisplayName: "Allowed locations" policyAssignmentName: "Deny-Rsrc-Locations" policyAssignmentDisplayName: "Limit allowed locations for Resources"

Resolution

1. Fix Permission Issues

Ensure the user account initiating registration possesses adequate role permissions on each subscription being onboarded:

Log in to the Azure Portal.
Navigate to Subscriptions and select the target subscription.
Select Access Control (IAM) > Add > Add role assignment.
Assign one of the following required roles to the initiating user:
- Owner
- User Access Administrator
- Role Based Access Control Administrator

2. Fix Azure Policy Restrictions

To resolve the location policy blockade:

Option 1 (Recommended - Exemption):
1. Open Azure Portal and navigate to Policy.
2. Select Assignments, then locate the assignment Limit allowed locations for Resources.
3. Click Create Exemption for the specific Subscription or Resource Group used by Druva.
Option 2 (Disable Policy Enforcement Temporarily):
1. Go to Policy > Assignments.
2. Select Edit Assignment for the conflicting policy.
3. Set Policy Enforcement to Disabled and save changes. Re-enable after onboarding completes.

Precautionary Note:

Verify required RBAC permissions and audit any active location/resource restriction policies prior to initiating subscription migration or onboarding.

Verification

Re-run the Azure subscription registration wizard in the Druva console.
Confirm that role definition creation completes without AuthorizationFailed messages.
Validate that Druva resources deploy successfully into the target Azure subscription without RequestDisallowedByPolicy errors.

Failed to Register Azure Subscriptions Due to Policy Restrictions and Insufficient Permissions