Azure course that tries to use Azure Cloud Shell fails with "RequestDisallowedByPolicy" using free account

Question

I was asked by Azure Support to post this question, just to see if anyone had a useful opinion.

I am stepping through MS Azure training courses. I created the usual free account to go through these. I've gone through a few dozen of them, and am now at this one:

https://docs.microsoft.com/en-us/learn/modules/secure-and-isolate-with-nsg-and-service-endpoints/3-exercise-network-security-groups?source=learn

This attempts to use the Azure PowerShell service. I had some trouble getting to the PowerShell page. It appears that if I'm not already logged into the portal, it goes into a semi-infinite loop, trying to get to the shell page, then trying to login, then the shell page, and finally it gives up and says "We couldn't sign you in. Please try again.".

However, I was able to work around this. If in a separate tab, I log into the Azure Portal, and then go back and follow the link to Azure Cloud Shell, it passes the login gate and sends me to the page where I choose Bash or PowerShell. The course specifies using Bash. When I select that, it then asks me to create a Storage object. When I confirm that, it gives me the following error (subscription id elided):

{
  "error": {
    "code": "RequestDisallowedByPolicy",
    "target": "cs733f82532facdx4f04x95b",
    "message": "Resource 'cs733f82532facdx4f04x95b' was disallowed by policy. Policy identifiers: '[{\"policyAssignment\":{\"name\":\"Enforce tag on resource\",\"id\":\"/subscriptions/xxxxx/providers/Microsoft.Authorization/policyAssignments/740514d625684aad84ef8ca0\"},\"policyDefinition\":{\"name\":\"Enforce tag on resource\",\"id\":\"/subscriptions/xxxxx/providers/Microsoft.Authorization/policyDefinitions/be3862a6-ca1e-40b0-a024-0c0c7d1e8b3e\"}}]'.",
    "additionalInfo": [
      {
        "type": "PolicyViolation",
        "info": {
          "policyDefinitionDisplayName": "Enforce tag on resource",
          "evaluationDetails": {
            "evaluatedExpressions": [
              {
                "result": "True",
                "expressionKind": "Field",
                "expression": "tags[Department]",
                "path": "tags[Department]",
                "targetValue": "false",
                "operator": "Exists"
              }
            ]
          },
          "policyDefinitionId": "/subscriptions/xxxxx/providers/Microsoft.Authorization/policyDefinitions/be3862a6-ca1e-40b0-a024-0c0c7d1e8b3e",
          "policyDefinitionName": "be3862a6-ca1e-40b0-a024-0c0c7d1e8b3e",
          "policyDefinitionEffect": "deny",
          "policyAssignmentId": "/subscriptions/xxxxx/providers/Microsoft.Authorization/policyAssignments/740514d625684aad84ef8ca0",
          "policyAssignmentName": "740514d625684aad84ef8ca0",
          "policyAssignmentDisplayName": "Enforce tag on resource",
          "policyAssignmentScope": "/subscriptions/xxxxx",
          "policyAssignmentParameters": {
            "tagName": {
              "value": "Department"
            }
          }
        }
      }
    ]
  }
}

I think the simple conclusion from this is that my free account doesn't have enough rights to do what is needed here. The documentation I've read seems to imply that I have to get additional rights on the account in order to do this. However, I'm just using a free account that I created to go through the Azure training courses. It doesn't really make sense to ask me to do this. I've seen other Azure courses create a temporary sandbox supposedly because they have particular objects pre-created in the sandbox, but I'm also thinking that the sandbox has particular permissions that are not available in the free account. It seems to me that the only reasonable fix for this problem is for that course to be refactored to use a temporary sandbox with the correct permissions.

I'm just looking for any opinions on this, and confirmations that this is what should be done.

Hannel Hannel · Accepted Answer · 2020-01-27T23:17:30

It doesn't look like you are creating resource, cloudshell storage, on your free subscription. Except if you added to a Work/Corporate tenant.

From the information you provide, subscription you are trying to use has a policy to enforce tags Department, mean any resource created should have a tag with Department information.

Azure course that tries to use Azure Cloud Shell fails with "RequestDisallowedByPolicy" using free account

1 Answers