The error message "AOR is not permitted by Allow/Deny list" indicates that the endpoint is not allowed to register with the VCS server because it is not on the Allow List or it is on the Deny List. To resolve this problem, you must correct the restriction policy settings.

The engineer must set the Enable Activation Code enterprise parameter to True. This will enable the use of activation codes for onboarding on-premises devices to a Cisco UCM server. The other options are not necessary to complete the configuration.
Here are the steps to complete the configuration:
Log in to the Cisco Unified Communications Manager (CUCM) Administration interface.
Go to System > Enterprise Parameters.
Set the Enable Activation Code enterprise parameter to True.
Click Save.
The activation code onboarding feature is now enabled. You can use it to onboard new phones to the CUCM server.

The Restrict setting in the Webex Calling dial plan prevents users from placing certain types of outbound calls. For example, you can use the Restrict setting to prevent users from making international calls or calls to premium-rate numbers.
The Block setting in the Webex Calling dial plan prevents users from placing any outbound calls. The Transfer to Number setting in the Webex Calling dial plan transfers all outbound calls to a specified number. The Reject setting in the Webex Calling dial plan rejects all outbound calls.
Here is a table summarizing the different dial plan settings and their effects:
Dial Plan Setting
Effect
Block
Prevents users from placing any outbound calls.
Transfer to Number
Transfers all outbound calls to a specified number.
Reject
Rejects all outbound calls.
Restrict
Prevents users from placing certain types of outbound calls.