For a rule to suppress an alert on a specific subscription, that alert type has to have been triggered at least once before the rule is created. https://docs.microsoft.com/en-us/azure/defender-for-cloud/alerts-suppression-rules#create-a-suppression-rule