Azure "subscription not found / disabled" on az deploy in CI

The Azure CLI tried to operate on a subscription that the logged-in principal cannot access, or that is disabled/expired. The request fails before reaching any resource, often after a login that itself succeeded.

What this error means

az fails with "The subscription '<id>' could not be found" (SubscriptionNotFound) or "The subscription is disabled and therefore marked as read only".

(SubscriptionNotFound) The subscription '00000000-0000-0000-0000-000000000000'
could not be found.
Code: SubscriptionNotFound

Common causes

The principal has no access to that subscription

The service principal is not assigned any role on the subscription, so from its view the subscription does not exist.

The subscription is disabled or expired

A past-due or disabled subscription is read-only or invisible, so deploys into it fail.

How to fix it

Set and verify the active subscription

1. List the subscriptions the principal can see.
2. Set the intended subscription explicitly, or pass --subscription on commands.
3. Confirm it is enabled before deploying.

az account list --query "[].{name:name, id:id, state:state}" -o table
az account set --subscription "$AZURE_SUBSCRIPTION_ID"

Grant the principal a role on the subscription

If the subscription is missing from the list, assign the CI principal a role at the subscription scope.

az role assignment create --assignee "$AZURE_CLIENT_ID" \
  --role Contributor --scope /subscriptions/$AZURE_SUBSCRIPTION_ID

How to prevent it

• Set the subscription explicitly in CI rather than relying on a default.
• Assign the CI principal a role on every subscription it deploys to.
• Monitor subscription state so a disabled/expired one is caught early.

Related guides