The global config command "aaa policy interface-config allow-subinterface" is required before any users can connect, to allow the creation of a sub-interface in the first place.
When the LNS tries to copy the virtual-template interface and add in any attributes received from RADIUS to terminate a PPP session on a new VAI sub-interface, the following message is logged if any config is present that requires a full VAI interface to be created (config that isn't supported on a sub-interface):
%FMANRP_ESS-4-FULLVAI: Session creation failed due to Full Virtual-Access Interfaces not being supported. Check that all applied Virtual-Template and RADIUS features support Virtual-Access sub-interfaces. swidb= 0x7F11844221E8, ifnum= 40