TRE Firewall Deployment Errors

Describe the bug
When deploying a new TRE (uksouth) I am getting a number of errors, I have tried twice (11th and 12th Feb)
I believe they are hitting the 30 minute timeout limit when creating the firewall, bastion and agw, maybe they depend on each other.

I will increase the timeout which may solve 3 of the 4 errors.
The DNS insertion also fails
"message": "Failed to upsert domain list, the characters "-" and "_" are not currently permitted in domain list domain names. domainListResourceId=/subscriptions//resourceGroups/rg-mytrename/providers/Microsoft.Network/dnsResolverDomainLists/dl-allowed-1, domain=a-msedge.net.",

2026-02-12T11:54:57.4984533Z [0m[1mazurerm_bastion_host.bastion[0]: Still creating... [29m50s elapsed][0m[0m
2026-02-12T11:55:03.2165083Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [29m50s elapsed][0m[0m
2026-02-12T11:55:13.2175416Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m0s elapsed][0m[0m
2026-02-12T11:55:23.2177729Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m10s elapsed][0m[0m
2026-02-12T11:55:33.2180592Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m20s elapsed][0m[0m
2026-02-12T11:55:43.2182340Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m30s elapsed][0m[0m
2026-02-12T11:55:53.2183506Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m40s elapsed][0m[0m
2026-02-12T11:56:03.2184635Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [30m50s elapsed][0m[0m
2026-02-12T11:56:13.2186807Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [31m0s elapsed][0m[0m
2026-02-12T11:56:23.2190462Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [31m10s elapsed][0m[0m
2026-02-12T11:56:33.2199704Z [0m[1mmodule.firewall.azurerm_firewall.fw: Still creating... [31m20s elapsed][0m[0m
2026-02-12T11:56:38.4699028Z [31m╷[0m[0m
2026-02-12T11:56:38.4704695Z [31m│[0m [0m[1m[31mError: [0m[0m[1mcreating Bastion Host (Subscription: "<mysubid>"
2026-02-12T11:56:38.4705176Z [31m│[0m [0mResource Group Name: "rg-mytrename"
2026-02-12T11:56:38.4705699Z [31m│[0m [0mBastion Host Name: "bas-mytrename"): polling after CreateOrUpdate: context deadline exceeded[0m
2026-02-12T11:56:38.4706100Z [31m│[0m [0m
2026-02-12T11:56:38.4706483Z [31m│[0m [0m[0m  with azurerm_bastion_host.bastion[0],
2026-02-12T11:56:38.4706960Z [31m│[0m [0m  on bastion.tf line 12, in resource "azurerm_bastion_host" "bastion":
2026-02-12T11:56:38.4707432Z [31m│[0m [0m  12: resource "azurerm_bastion_host" "bastion" [4m{[0m[0m
2026-02-12T11:56:38.4707774Z [31m│[0m [0m
2026-02-12T11:56:38.4708063Z [31m╵[0m[0m
2026-02-12T11:56:38.4716789Z [31m╷[0m[0m
2026-02-12T11:56:38.4717606Z [31m│[0m [0m[1m[31mError: [0m[0m[1mFailed to create/update resource[0m
2026-02-12T11:56:38.4718365Z [31m│[0m [0m
2026-02-12T11:56:38.4718960Z [31m│[0m [0m[0m  with azapi_resource.domain_list_allow[0],
2026-02-12T11:56:38.4719449Z [31m│[0m [0m  on dns-policy.tf line 15, in resource "azapi_resource" "domain_list_allow":
2026-02-12T11:56:38.4720095Z [31m│[0m [0m  15: resource "azapi_resource" "domain_list_allow" [4m{[0m[0m
2026-02-12T11:56:38.4720600Z [31m│[0m [0m
2026-02-12T11:56:38.4722460Z [31m│[0m [0mcreating/updating Resource: (ResourceId "/subscriptions/<mysubid>/resourceGroups/rg-mytrename/providers/Microsoft.Network/dnsResolverDomainLists/dl-allowed-1" / Api Version "2023-07-01-preview"): GET https://management.azure.com/subscriptions/<mysubid>/resourceGroups/rg-mytrename/providers/Microsoft.Network/locations/uksouth/dnsResolverPolicyOperationStatuses/eyJPcGVyYXRpb25UeXBlIjoiQ29udmVyZ2VEbnNSZXNvbHZlckRvbWFpbkxpc3QiLCJPcGVyYXRpb25JZCI6Ijk1NmQ2MmUwLTRhY2QtNGQyNC1hNzYwLThlZWYwMzMwY2M4NCJ9
2026-02-12T11:56:38.4723841Z [31m│[0m [0m--------------------------------------------------------------------------------
2026-02-12T11:56:38.4724280Z [31m│[0m [0mRESPONSE 200: 200 OK
2026-02-12T11:56:38.4724796Z [31m│[0m [0mERROR CODE: BadRequest
2026-02-12T11:56:38.4725422Z [31m│[0m [0m--------------------------------------------------------------------------------
2026-02-12T11:56:38.4725812Z [31m│[0m [0m{
2026-02-12T11:56:38.4731836Z [31m│[0m [0m  "id": "/subscriptions/<mysubid>/resourceGroups/rg-mytrename/providers/Microsoft.Network/locations/uksouth/dnsResolverOperationStatuses/eyJPcGVyYXRpb25UeXBlIjoiQ29udmVyZ2VEbnNSZXNvbHZlckRvbWFpbkxpc3QiLCJPcGVyYXRpb25JZCI6Ijk1NmQ2MmUwLTRhY2QtNGQyNC1hNzYwLThlZWYwMzMwY2M4NCJ9",
2026-02-12T11:56:38.4734087Z [31m│[0m [0m  "name": "eyJPcGVyYXRpb25UeXBlIjoiQ29udmVyZ2VEbnNSZXNvbHZlckRvbWFpbkxpc3QiLCJPcGVyYXRpb25JZCI6Ijk1NmQ2MmUwLTRhY2QtNGQyNC1hNzYwLThlZWYwMzMwY2M4NCJ9",
2026-02-12T11:56:38.4735043Z [31m│[0m [0m  "startTime": "2026-02-12T11:24:10.0000000Z",
2026-02-12T11:56:38.4735507Z [31m│[0m [0m  "endTime": "2026-02-12T11:24:12.0000000Z",
2026-02-12T11:56:38.4735879Z [31m│[0m [0m  "status": "Failed",
2026-02-12T11:56:38.4736214Z [31m│[0m [0m  "error": {
2026-02-12T11:56:38.4736552Z [31m│[0m [0m    "details": null,
2026-02-12T11:56:38.4740159Z [31m│[0m [0m    "code": "BadRequest",
2026-02-12T11:56:38.4741501Z [31m│[0m [0m    "message": "Failed to upsert domain list, the characters \"-\" and \"_\" are not currently permitted in domain list domain names. domainListResourceId=/subscriptions/<mysubid>/resourceGroups/rg-mytrename/providers/Microsoft.Network/dnsResolverDomainLists/dl-allowed-1, domain=a-msedge.net.",
2026-02-12T11:56:38.4742132Z [31m│[0m [0m    "target": null
2026-02-12T11:56:38.4742439Z [31m│[0m [0m  }
2026-02-12T11:56:38.4742722Z [31m│[0m [0m}
2026-02-12T11:56:38.4743182Z [31m│[0m [0m--------------------------------------------------------------------------------
2026-02-12T11:56:38.4743418Z [31m│[0m [0m
2026-02-12T11:56:38.4743591Z [31m╵[0m[0m
2026-02-12T11:56:38.4743809Z [31m╷[0m[0m
2026-02-12T11:56:38.4744097Z [31m│[0m [0m[1m[31mError: [0m[0m[1mcreating Application Gateway (Subscription: "<mysubid>"
2026-02-12T11:56:38.4744359Z [31m│[0m [0mResource Group Name: "rg-mytrename"
2026-02-12T11:56:38.4744684Z [31m│[0m [0mApplication Gateway Name: "agw-mytrename"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:
2026-02-12T11:56:38.4744922Z [31m│[0m [0m
2026-02-12T11:56:38.4745120Z [31m│[0m [0mStatus: "InternalServerError"
2026-02-12T11:56:38.4745308Z [31m│[0m [0mCode: ""
2026-02-12T11:56:38.4745511Z [31m│[0m [0mMessage: "An error occurred."
2026-02-12T11:56:38.4745702Z [31m│[0m [0mActivity Id: ""
2026-02-12T11:56:38.4745875Z [31m│[0m [0m
2026-02-12T11:56:38.4746049Z [31m│[0m [0m---
2026-02-12T11:56:38.4746221Z [31m│[0m [0m
2026-02-12T11:56:38.4746569Z [31m│[0m [0mAPI Response:
2026-02-12T11:56:38.4746739Z [31m│[0m [0m
2026-02-12T11:56:38.4746916Z [31m│[0m [0m----[start]----
2026-02-12T11:56:38.4747200Z [31m│[0m [0m{"status":"Failed","error":{"code":"InternalServerError","message":"An error occurred.","details":[]}}
2026-02-12T11:56:38.4747428Z [31m│[0m [0m-----[end]-----
2026-02-12T11:56:38.4747608Z [31m│[0m [0m[0m
2026-02-12T11:56:38.4747783Z [31m│[0m [0m
2026-02-12T11:56:38.4748011Z [31m│[0m [0m[0m  with module.appgateway.azurerm_application_gateway.agw,
2026-02-12T11:56:38.4748304Z [31m│[0m [0m  on appgateway/appgateway.tf line 22, in resource "azurerm_application_gateway" "agw":
2026-02-12T11:56:38.4748577Z [31m│[0m [0m  22: resource "azurerm_application_gateway" "agw" [4m{[0m[0m
2026-02-12T11:56:38.4748772Z [31m│[0m [0m
2026-02-12T11:56:38.4748932Z [31m╵[0m[0m
2026-02-12T11:56:38.4749094Z [31m╷[0m[0m
2026-02-12T11:56:38.4749390Z [31m│[0m [0m[1m[31mError: [0m[0m[1mcreating/updating Azure Firewall (Subscription: "<mysubid>"
2026-02-12T11:56:38.4749658Z [31m│[0m [0mResource Group Name: "rg-mytrename"
2026-02-12T11:56:38.4749975Z [31m│[0m [0mAzure Firewall Name: "fw-mytrename"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:
2026-02-12T11:56:38.4750206Z [31m│[0m [0m
2026-02-12T11:56:38.4750402Z [31m│[0m [0mStatus: "InternalServerError"
2026-02-12T11:56:38.4750591Z [31m│[0m [0mCode: ""
2026-02-12T11:56:38.4750793Z [31m│[0m [0mMessage: "An error occurred."
2026-02-12T11:56:38.4750989Z [31m│[0m [0mActivity Id: ""
2026-02-12T11:56:38.4751163Z [31m│[0m [0m
2026-02-12T11:56:38.4751590Z [31m│[0m [0m---
2026-02-12T11:56:38.4751774Z [31m│[0m [0m
2026-02-12T11:56:38.4751948Z [31m│[0m [0mAPI Response:
2026-02-12T11:56:38.4752120Z [31m│[0m [0m
2026-02-12T11:56:38.4752306Z [31m│[0m [0m----[start]----
2026-02-12T11:56:38.4752581Z [31m│[0m [0m{"status":"Failed","error":{"code":"InternalServerError","message":"An error occurred.","details":[]}}
2026-02-12T11:56:38.4752908Z [31m│[0m [0m-----[end]-----
2026-02-12T11:56:38.4753089Z [31m│[0m [0m[0m
2026-02-12T11:56:38.4753253Z [31m│[0m [0m
2026-02-12T11:56:38.4753474Z [31m│[0m [0m[0m  with module.firewall.azurerm_firewall.fw,
2026-02-12T11:56:38.4753739Z [31m│[0m [0m  on firewall/firewall.tf line 30, in resource "azurerm_firewall" "fw":
2026-02-12T11:56:38.4753989Z [31m│[0m [0m  30: resource "azurerm_firewall" "fw" [4m{[0m[0m
2026-02-12T11:56:38.4754180Z [31m│[0m [0m
2026-02-12T11:56:38.4754343Z [31m╵[0m[0m
2026-02-12T11:56:38.5155419Z Script done.
2026-02-12T11:56:38.5224446Z Terraform Error

Steps to reproduce

1. deploy a new TRE with ENABLE_DNS_POLICY=true

Azure TRE release version (e.g. v0.14.0 or main):

Deployed Azure TRE components - click the (i) in the UI:

Start with dns-policy.tf, where the DNS domain-list failure is reported, and reproduce a deployment with ENABLE_DNS_POLICY=true. Then inspect bastion.tf, appgateway/appgateway.tf, and firewall/firewall.tf for the reported timeout and Azure API failures. Done means a new TRE deployment completes without these errors.