I am trying to create a manged instance within an existing subnet in Azure. I have configured the subnet with the script provided by Microsoft which tells me the subnet is prepared.

When I create the managed instance I get

'Deployment validation failed. Additional details from the underlying API that might be helpful: The template deployment failed because of policy violation. Please see details for more information.'

If I check the activity log I see

'InvalidTemplateDeployment' and 'Operation name 'deny' Policy action' with some further infiormation under the JSON tab e.g. ' eventTimestamp": "2019-10-30T10:22:16.9421982Z", "id": "/subscriptions/xx/resourceGroups/xx/providers/Microsoft.Sql/managedInstances/xx-sqlmi/events/23572bf7-dbbb-4ba0-a13e-075a8ae58652/ticks/637080277369421982", "level": "Error", "operationId": "a12adf73-dd1b-4216-80df-dea57d514ba1", "operationName": { "value": "Microsoft.Authorization/policies/deny/action", "localizedValue": "'deny' Policy action." '

None of this seems to me very helpful, how do i diagnose and fix this error? Is it that my network/subnet configuration is wrong? Permissions? A policy which needs to specify managed instances can be created?

  • I am trying to reproduce the issue. One question are you getting this error immediately after running the deployment or after sometime ? For me it worked just fine this is just creating route table
    – Shanky
    Commented Oct 30, 2019 at 12:13
  • It happens seconds after pressing create which makes me think it is a permissions issue? A policy forbidding the creation? I did not set up this virtual network and / or resource group, I only set up the subnet for the managed instance to use.
    – jack
    Commented Oct 30, 2019 at 12:46

1 Answer 1


Figured out the solution:

Go to the resource group you want to create the managed instance in > Policies > Assignments > Allowed resource types (with the scope subscription/resourcegroupname) parameters > then from the allowed resource types dropdown select Microsoft.Sql.managedInstances

Sign out and into your account, then managed instance will deploy.

When I got the 'Validate Deployment - 'deny' Policy action' error I went to the Activity log, clicked the Validate Deployment error dropown, clicked the 'deny' Policy action, then looked at the JSON tab - if I looked sequntially to see where the error originated I found this section

"category": {
    "value": "Policy",
    "localizedValue": "Policy"
"eventTimestamp": "2019-10-30T13:04:54.8516173Z",
"id": "/subscriptions/XXXXXXX/resourceGroups/XXXXXXXXXXXXX/providers/Microsoft.Sql/managedInstances/minamehere/events/77999a0f-d551-45e0-9b3b-1156b246b50d/ticks/637080374948516173",

"resourceId": "/subscriptions/XXXXXXXXX/resourceGroups/XXXXXXX/providers/Microsoft.Sql/managedInstances/minamehere", "status": { "value": "Failed", "localizedValue": "Failed"

Which is what led me to policies and allowed me to troubleshoot and fix the issue - somewhere I knew I needed to add 'Microsoft.Sql/managedInstances' to the Policy category, which fits with the deny policy error I was experiencing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.