Share via

During deployment of Azure IoT Operations, setup can't be completed as the device registry namespace creation fails with "validation error"

CKAU 20 Reputation points
2025-11-14T07:30:53.1+00:00

Hi,

we are currently evaluating Azure IoT Operations and deployed a view test instances. This worked until about a week ago. Now when I want to onboard a fresh instance on a new ARC enabled cluster I can't complete the namespace setup in the dependency management step in the wizard as it fails with "validation error". I don't know what I do wrong there as it only needs a name and region. This would be the input:

{
    "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "name": {
            "value": "cl-az-rt-ns-351-02"
        },
        "location": {
            "value": "westeurope"
        },
        "tagsByResource": {
            "value": {
                "microsoft.deviceregistry/namespaces": {
                    "Description": "some_description"
                }
            }
        }
    }
}

The screenshot from the documentation looks different from what we get in the setup wizard.
Documentation:
User's image

What we get in the wizard:
User's image

I guess this may be related to the GA release of version 1.2 for Azure IoT Operations but how can we complete the setup? Currently we can't deploy Azure IoT Operations.

Azure IoT Operations
Azure IoT Operations
Azure IoT Operations is a set of modular services enabled by Azure Arc.

2 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Nikhil Jha (Accenture International Limited) 4,150 Reputation points Microsoft External Staff Moderator
    2025-12-01T10:18:30.5333333+00:00

    Hello CKAU,
    I understand you are unable to complete the deployment of Azure IoT Operations (AIO) because the creation of the Device Registry Namespace fails with a ResourceCreationValidateFailed error, both in the Azure Portal wizard and via the CLI.

    This is a blocking issue preventing you from onboarding new instances. The error code ResourceCreationValidateFailed (HTTP 400) indicates that the Resource Provider received the request but rejected it because the data provided did not meet specific validation criteria. Since the CLI output is generic, we need to dig deeper to find the specific validation rule that failed.

    Recommended steps:

    Step 1: Inspect the Azure Activity Log

    1. Go to the Azure Portal and search for Activity Log.
    2. Filter the Timespan when you ran the command.
    3. Look for an operation named "Create or Update Namespace" (or similar under Microsoft.DeviceRegistry) that has a status of Failed.
    4. Click on that operation to open the details pane.
    5. Click the JSON tab at the bottom of the details pane.
    6. Scroll down to properties -> statusMessage. This field often contains the specific text explaining why validation failed (e.g., "Namespace name already in use globally," "Subscription not authorized," or "Quota exceeded").

    Step 2: Check for "Soft Deleted" Resources

    • A common cause for validation failure with naming (even when trying new names) is if a previously deleted resource is in a "soft delete" state or if the name is reserved globally (not just within your resource group).
    • Although you tried variations like cl-az-rt-ns-351-02, ensure that the pattern doesn't violate length or character constraints (alphanumeric and hyphens, typically max 63 chars).

    Step 3: Update/Reinstall the CLI Extension

    You are using IotOperationsCliExtension/2.0.1. Since AIO is evolving rapidly (GA v1.2), version mismatches between the local extension and the service backend can cause payload validation errors.

    1. Update the extension to the absolute latest: 
         az extension update --name azure-iot-ops
    2. If that doesn't work, try removing and re-adding it to clear any cached schemas: 
         az extension remove --name azure-iot-ops
   az extension add --name azure-iot-ops

    Step 4: Verify Resource Provider Registration

    Even though you checked them, sometimes the Microsoft.DeviceRegistry provider needs a refresh.

    1.Go to Subscriptions > Your Subscription > Resource providers.

    1. Search for Microsoft.DeviceRegistry.
    2. Select it and click Re-register. (This is non-destructive).

    Step 5: Check Azure Policy

    Since you are the Owner, permissions are fine. However, an Azure Policy assigned at the Management Group or Subscription level could be blocking the creation of this specific resource type (Microsoft.DeviceRegistry/namespaces) or enforcing tag compliance that the wizard isn't satisfying.

    • Check the Activity Log (from Step 1) specifically for "Policy" related errors.

    If this answer helps clarify the path to resolution, kindly "Accept the answer" to support the community looking for similar remediation.

  2. Dominic Garrity 0 Reputation points Microsoft Employee
    2025-12-03T18:34:57.5433333+00:00

    Hi CKAU,

    Dominic here, from the product team. Thank you for flagging this and working with us.

    After refreshing our docs with a new screenshot, we dug into the namespace issue and were able to identify its root cause: Azure Device Registry (ADR) was not able to handle HTTP headers as large as yours. However, we just updated our ingress gateway controller to support headers up to 128 KB in size. Our update will go out with the next production deployment of the Microsoft.DeviceRegistry 2025-10-01 API, likely within the next week or two. As soon as it does, you should be able to create the namespace and deploy your AIO instance just as you originally attempted. No need to move from West Europe, use a different API version, or adjust your setup.

    Hope this helps! If anything still gives you trouble, please let us know.

    Dominic

    0 comments

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.