ADF when publishing, the arm templates generation failed with Corporate Public network Disabled errror- how to resolve?

Hi Nguyen, Hoa

The error message:

“RequestDisallowedByPolicy – Public network access on Azure Data Factory should be disabled”

indicates that an Azure Policy in your environment is blocking the publish/deployment operation because the Data Factory resource is currently configured with:

publicNetworkAccess = Enabled

During the publish process, Azure validates the generated ARM template against organizational policies. If the template or existing factory configuration contains public network access enabled, the deployment is denied by policy.

To resolve this issue, please check the following:

Go to Azure Data Factory → Networking

Set Public network access to Disabled

Save the changes and retry the publish operation

If your organization requires private-only access to ADF Studio or the management plane, you should also configure a Private Endpoint and corresponding Private DNS integration.

Microsoft documentation:

Azure Data Factory Private Link
https://learn.microsoft.com/azure/data-factory/data-factory-private-link

Troubleshoot CI/CD and publish issues in ADF
https://learn.microsoft.com/azure/data-factory/ci-cd-github-troubleshoot-guide

Additionally, if you are using CI/CD pipelines or custom ARM deployments, verify that your ARM template or parameter files are not explicitly setting:

"publicNetworkAccess": "Enabled"

Otherwise, Azure Policy will continue blocking the deployment even after updating the portal configuration.

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

The failure is caused by an Azure Policy assignment that explicitly blocks Data Factory resources with public network access enabled. The error RequestDisallowedByPolicy means the ARM deployment (triggered by ADF publish) is trying to deploy or update the factory in a way that violates this policy, so the deployment is rejected and the publish fails.

From the policy description in the error:

Public network access on Azure Data Factory should be disabled

Resolution options are limited because the policy cannot be overridden at the subscription/management group level by the project team. The deployment must comply with the policy:

1. Ensure the factory is configured with public network access disabled
   • The policy requires public network access to be disabled. The factory’s networking configuration must reflect this (for example, using only private endpoints / managed virtual network).
   • Any ARM template or tag that sets or implies publicNetworkAccess = Enabled will be blocked.
2. Avoid enabling public network access via tags or ARM
   • In some troubleshooting scenarios, public network access is enabled by setting a tag in the factory (for example, using the Factories - Update REST API with:

          { "tags": { "publicNetworkAccess":"Enabled" } }
     

     ).
   • In an environment where a corporate policy requires public network access to be disabled, this approach will fail with RequestDisallowedByPolicy and must not be used.
3. Align CI/CD templates with policy
   • Review the generated ARMTemplateForFactory.json and any parameter files to ensure they do not configure public network access or other settings that violate the policy.
   • If the template currently sets public access (for example through tags or networking properties), remove or change those settings so that the resulting factory configuration keeps public access disabled.
4. Work with the policy owner if a temporary exception is required
   • If publishing absolutely requires public network access (for example, to register a self-hosted IR as described in the troubleshooting guidance), then the only compliant option is for the policy owner (central IT / security) to adjust or temporarily exempt the factory from that policy. Without such a change, any deployment that enables public access will continue to be blocked.

In summary, to restore successful ARM template generation and publishing, the Data Factory deployment must be modified so that it does not enable public network access, thereby complying with the Public network access on Azure Data Factory should be disabled policy and avoiding RequestDisallowedByPolicy during publish.

References:

• Resolve errors for request disallowed by policy
• Troubleshoot Azure Data Factory and Synapse Analytics security and access control issues
• Continuous integration and delivery in Azure Data Factory

@SAI JAGADEESH KUDIPUDI Your answer is accepted and most helpful.
We asked for a temporary exemption to buy us some time to plan and prep for the private endpoints.
I do not see a place where I can mark your answer as accepted. Thank you!