@@ -406,7 +406,11 @@ func validateAzureExchangeTargets(targets []AzureExchangeTargetBody, subscriptio
 		if t.SKU == "" {
 			return NewClientError(400, fmt.Sprintf("targets[%d].sku is required", i))
 		}
-		if t.Location == "" {
+		// Blank-but-not-empty is rejected too: targetLocations trims before
+		// it builds the Regions constraint, so a whitespace-only location
+		// would otherwise reach the permission check as "" -- a region no
+		// permission can name.
+		if strings.TrimSpace(t.Location) == "" {
 			return NewClientError(400, fmt.Sprintf("targets[%d].location is required", i))
 		}
 		if t.BillingScopeID != "" && !strings.EqualFold(t.BillingScopeID, scope) {
@@ -494,17 +498,34 @@ func toAzureExchangeTargets(targets []AzureExchangeTargetBody, subscriptionID st
 	return out, nil
 }
 
-// targetLocations returns the de-duplicated set of target locations, used to
-// populate the Regions dimension of the execute:ri-exchange constraint
-// check. Callers must have already validated that every target has a
-// non-empty Location.
+// targetLocations returns the de-duplicated, canonically lower-cased set of
+// target locations, used to populate the Regions dimension of the
+// execute:ri-exchange constraint check. Callers must have already validated
+// that every target has a non-blank Location.
+//
+// Azure treats location names case-insensitively and its own APIs return the
+// lower-case form, so lower case is the canonical spelling. Normalizing
+// before the dedup collapses "EastUS" -- the casing the Azure portal
+// displays -- and "eastus" into the single region they actually are, so the
+// constraint set names each target region exactly once rather than demanding
+// a permission for two spellings of one place.
+//
+// auth.matchAllRegionsConstraint compares case-insensitively as well, so a
+// permission stored in either casing matches either way. Normalizing here
+// keeps the two layers agreeing on what a region is instead of leaving the
+// constraint set's accuracy resting on the matcher's leniency.
+//
+// toAzureExchangeTargets sends Azure the raw, un-normalized Location. That
+// is not a gap: Azure resolves either casing to the same region, so the
+// region authorized here is the region the exchange lands in.
 func targetLocations(targets []AzureExchangeTargetBody) []string {
 	seen := make(map[string]bool, len(targets))
 	out := make([]string, 0, len(targets))
 	for _, t := range targets {
-		if !seen[t.Location] {
-			seen[t.Location] = true
-			out = append(out, t.Location)
+		location := strings.ToLower(strings.TrimSpace(t.Location))
+		if !seen[location] {
+			seen[location] = true
+			out = append(out, location)
 		}
 	}
 	return out
@@ -814,21 +835,6 @@ func checkAzureExchangeMoneyGuardrails(preview *azurecompute.ExchangePreview, ma
 	return nil
 }
 
-// executeAzureExchange executes an Azure RI exchange with mandatory
-// spend-cap and currency guardrails. Requires "execute:ri-exchange"
-// (deliberately separate from execute:purchases), mirroring the AWS
-// executeExchange handler: RI exchanges are financially irreversible once
-// submitted.
-//
-// Unlike a design that executes a client-supplied session_id, this handler
-// never trusts the caller's own pricing: it re-runs CalculateExchange itself
-// against the caller's sources/targets, validates the FRESH quote against
-// every guardrail in checkAzureExchangeMoneyGuardrails, and only then calls
-// ExecuteExchange with the SessionID *that fresh call returned*. A
-// client-supplied or stale session would bypass every guardrail below, so
-// the server always re-quotes immediately before committing.
-//
-// POST /api/ri-exchange/azure-instances/exchange.
 // parseAzureExecuteRequest decodes and validates an execute request body and
 // parses its spend cap into an exact rational.
 //
@@ -851,6 +857,21 @@ func parseAzureExecuteRequest(rawBody string) (AzureExecuteExchangeRequestBody,
 	return body, maxRat, nil
 }
 
+// executeAzureExchange executes an Azure RI exchange with mandatory
+// spend-cap and currency guardrails. Requires "execute:ri-exchange"
+// (deliberately separate from execute:purchases), mirroring the AWS
+// executeExchange handler: RI exchanges are financially irreversible once
+// submitted.
+//
+// Unlike a design that executes a client-supplied session_id, this handler
+// never trusts the caller's own pricing: it re-runs CalculateExchange itself
+// against the caller's sources/targets, validates the FRESH quote against
+// every guardrail in checkAzureExchangeMoneyGuardrails, and only then calls
+// ExecuteExchange with the SessionID *that fresh call returned*. A
+// client-supplied or stale session would bypass every guardrail below, so
+// the server always re-quotes immediately before committing.
+//
+// POST /api/ri-exchange/azure-instances/exchange.
 func (h *Handler) executeAzureExchange(ctx context.Context, req *events.LambdaFunctionURLRequest) (any, error) {
 	session, err := h.requirePermission(ctx, req, "execute", "ri-exchange")
 	if err != nil {
 
@@ -120,6 +120,8 @@ func TestValidateAzureOfferingsBody(t *testing.T) {
 	missingSKU.SKU = ""
 	missingLocation := azureOfferingsTarget()
 	missingLocation.Location = ""
+	blankLocation := azureOfferingsTarget()
+	blankLocation.Location = "   "
 	foreignBillingScope := azureOfferingsTarget()
 	foreignBillingScope.BillingScopeID = "/subscriptions/someone-elses-sub"
 	zeroTargetQty := azureOfferingsTarget()
@@ -177,6 +179,14 @@ func TestValidateAzureOfferingsBody(t *testing.T) {
 			AzureCompatibleOfferingsRequestBody{SubscriptionID: "sub-1", Sources: []AzureExchangeSourceBody{azureOfferingsSource()}, Targets: []AzureExchangeTargetBody{missingLocation}},
 			"targets[0].location is required",
 		},
+		{
+			// Whitespace-only survives the empty check but trims to "" in
+			// targetLocations, i.e. a Regions constraint entry no permission
+			// can name. Reject it at the boundary instead.
+			"target location is whitespace only",
+			AzureCompatibleOfferingsRequestBody{SubscriptionID: "sub-1", Sources: []AzureExchangeSourceBody{azureOfferingsSource()}, Targets: []AzureExchangeTargetBody{blankLocation}},
+			"targets[0].location is required",
+		},
 		{
 			"target names a foreign billing scope",
 			AzureCompatibleOfferingsRequestBody{SubscriptionID: "sub-1", Sources: []AzureExchangeSourceBody{azureOfferingsSource()}, Targets: []AzureExchangeTargetBody{foreignBillingScope}},
@@ -1256,6 +1266,124 @@ func TestExecuteAzureExchange_ConstraintSetPinsAllDimensions(t *testing.T) {
 	assert.InDelta(t, 100.00, c.MaxPurchaseAmount, 0.0001)
 }
 
+// TestTargetLocations_CanonicalizesCase pins the normalization targetLocations
+// applies before its output becomes the Regions dimension of the
+// execute:ri-exchange constraint check.
+//
+// The permission side compares region names literally, so an un-normalized
+// "EastUS" -- the spelling the Azure portal shows -- would not match a
+// permission stored as "eastus", and the caller would be 403'd out of a
+// region they legitimately hold. Normalizing before the dedup additionally
+// collapses "EastUS" and "eastus" into the single region they actually are,
+// instead of submitting two entries that must both be permitted.
+func TestTargetLocations_CanonicalizesCase(t *testing.T) {
+	tests := []struct {
+		name    string
+		targets []AzureExchangeTargetBody
+		want    []string
+	}{
+		{
+			name:    "no targets yields an empty set",
+			targets: nil,
+			want:    []string{},
+		},
+		{
+			name:    "already-canonical locations pass through in first-seen order",
+			targets: []AzureExchangeTargetBody{{Location: "westeurope"}, {Location: "eastus"}},
+			want:    []string{"westeurope", "eastus"},
+		},
+		{
+			name:    "mixed-case location is lower-cased",
+			targets: []AzureExchangeTargetBody{{Location: "EastUS"}},
+			want:    []string{"eastus"},
+		},
+		{
+			name:    "case variants of one region collapse into a single entry",
+			targets: []AzureExchangeTargetBody{{Location: "EastUS"}, {Location: "eastus"}, {Location: "EASTUS"}},
+			want:    []string{"eastus"},
+		},
+		{
+			name:    "surrounding whitespace is trimmed before dedup",
+			targets: []AzureExchangeTargetBody{{Location: "  EastUS "}, {Location: "eastus"}},
+			want:    []string{"eastus"},
+		},
+		{
+			name: "distinct regions survive while their case variants collapse",
+			targets: []AzureExchangeTargetBody{
+				{Location: "EastUS"},
+				{Location: "WestEurope"},
+				{Location: "eastus"},
+			},
+			want: []string{"eastus", "westeurope"},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.want, targetLocations(tt.targets))
+		})
+	}
+}
+
+// TestExecuteAzureExchange_ConstraintRegionsAreLowerCased drives the same
+// normalization through the handler, so the constraint set actually submitted
+// for a portal-cased request is pinned and not merely the helper's return
+// value. Without it, a body naming "EastUS" and "eastus" would submit two
+// Regions entries in the portal's casing and the permission check would
+// compare them literally against the lower-case names permissions store.
+func TestExecuteAzureExchange_ConstraintRegionsAreLowerCased(t *testing.T) {
+	ctx := context.Background()
+	var captured []auth.PermissionConstraints
+
+	mockAuth := new(MockAuthService)
+	mockAuth.On("ValidateSession", ctx, "tok").Return(&Session{UserID: "user-1"}, nil)
+	mockAuth.On("HasPermissionAPI", ctx, "user-1", "execute", "ri-exchange").Return(true, nil)
+	allowAnyAccountScope(mockAuth)
+	mockAuth.On("HasPermissionForConstraintsAPI", ctx, "user-1", "execute", "ri-exchange",
+		mock.MatchedBy(func(sets []auth.PermissionConstraints) bool {
+			captured = sets
+			return true
+		})).Return(true, nil)
+	t.Cleanup(func() { mockAuth.AssertExpectations(t) })
+
+	mockStore := &MockConfigStore{}
+	mockStore.GetCloudAccountByExternalIDFn = func(_ context.Context, _, _ string) (*config.CloudAccount, error) {
+		return &config.CloudAccount{ID: "acct-sub-1"}, nil
+	}
+
+	opsClient := new(mockAzureExchangeOpsClient)
+	ownsAzureSource(opsClient)
+	opsClient.On("CalculateExchange", ctx, mock.Anything, mock.Anything).Return(
+		&azurecompute.ExchangePreview{SessionID: "sess-case", NetPayable: toPtr(10.00), NetPayableCurrency: "USD"},
+		[]azurecompute.CompatibleOffering{}, nil,
+	)
+	opsClient.On("ExecuteExchange", ctx, "sess-case").Return(
+		&azurecompute.ExchangeResult{SessionID: "sess-case", Status: "Succeeded"}, nil,
+	)
+	t.Cleanup(func() { opsClient.AssertExpectations(t) })
+
+	h := &Handler{auth: mockAuth, config: mockStore, azureExchangeFactory: func(_ string) azureExchangeClient { return opsClient }}
+	_, err := h.executeAzureExchange(ctx, &events.LambdaFunctionURLRequest{
+		Headers: map[string]string{"authorization": "Bearer tok"},
+		Body: `{
+			"subscription_id": "sub-1",
+			"sources": [{"reservation_id": "res-1", "quantity": 1}],
+			"targets": [
+				{"sku": "Standard_D4s_v3", "location": "EastUS", "term": "P1Y", "quantity": 1},
+				{"sku": "Standard_D8s_v3", "location": "WestEurope", "term": "P3Y", "quantity": 2},
+				{"sku": "Standard_D2s_v3", "location": "eastus", "term": "P1Y", "quantity": 1}
+			],
+			"max_payment_due": "100.00",
+			"currency": "USD"
+		}`,
+	})
+	require.NoError(t, err)
+
+	require.Len(t, captured, 1)
+	assert.Equal(t, []string{"eastus", "westeurope"}, captured[0].Regions,
+		"portal-cased target locations must reach the permission check lower-cased and de-duplicated")
+}
+
 // TestExecuteAzureExchange_LowercaseUSDTakesUSDCapPath closes the other half
 // of the currency case-insensitivity pairing.
 //
 
@@ -4,6 +4,7 @@ import (
 	"context"
 	"errors"
 	"fmt"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -241,7 +242,7 @@ func (s *Service) matchConstraints(permConstraints, reqConstraints *PermissionCo
 	return s.matchStringListConstraints(permConstraints.AccountIDs, reqConstraints.AccountIDs) &&
 		s.matchStringListConstraints(permConstraints.Providers, reqConstraints.Providers) &&
 		s.matchStringListConstraints(permConstraints.Services, reqConstraints.Services) &&
-		s.matchStringListConstraints(permConstraints.Regions, reqConstraints.Regions) &&
+		s.matchAllRegionsConstraint(permConstraints.Regions, reqConstraints.Regions) &&
 		s.matchPurchaseAmountConstraint(permConstraints.MaxPurchaseAmount, reqConstraints.MaxPurchaseAmount)
 }
 
@@ -265,6 +266,43 @@ func (s *Service) matchStringListConstraints(permList, reqList []string) bool {
 	return true
 }
 
+// matchAllRegionsConstraint is the Regions dimension's matcher: EVERY
+// requested region must be permitted, not merely one of them.
+//
+// Regions is the one dimension where a single request legitimately spans
+// several values: an Azure RI exchange takes a list of targets, and
+// handler_ri_exchange.go's targetLocations feeds all of their locations in
+// at once. Under the generic containsAny rule that made the region
+// constraint bypassable -- a caller permitted only in eastus could attach a
+// westus target, containsAny would find eastus in the permitted set, return
+// true, and the exchange would execute for BOTH regions. "Regions limits to
+// specific regions" (types.go) cannot mean "limits to requests that mention
+// at least one permitted region".
+//
+// Every other dimension keeps containsAny: a request names one provider,
+// one service, one account, so for them any-match and all-match coincide.
+//
+// Comparison is case-insensitive so a permission stored as "EastUS" still
+// matches the canonical lower-case form callers are normalized to; the
+// empty-list semantics are unchanged from matchStringListConstraints (an
+// unconstrained permission, or a request that does not name a region, still
+// matches).
+func (s *Service) matchAllRegionsConstraint(permRegions, reqRegions []string) bool {
+	if len(permRegions) == 0 || len(reqRegions) == 0 {
+		return true
+	}
+	permitted := make(map[string]bool, len(permRegions))
+	for _, r := range permRegions {
+		permitted[strings.ToLower(strings.TrimSpace(r))] = true
+	}
+	for _, r := range reqRegions {
+		if !permitted[strings.ToLower(strings.TrimSpace(r))] {
+			return false
+		}
+	}
+	return true
+}
+
 // matchPurchaseAmountConstraint checks if requested amount is within permitted limit.
 func (s *Service) matchPurchaseAmountConstraint(permMax, reqMax float64) bool {
 	if permMax > 0 && reqMax > permMax {