Virtual machine errors

VM errors arrive as Resource Manager errors (often wrapped in DeploymentFailed: guides/arm/debug-failed-deployment.md). SKU not offered in a region or zone (SkuNotAvailable) and core quota (OperationNotAllowed … exceeding quota limits of Core) are in reference/arm/errors.md; read live values with az vm list-skus -l <region> --size <size> --all -o table and az vm list-usage -l <region> -o table. This page covers the rest.

Allocation (capacity at the moment of the request)

Code / message	Cause → fix
`AllocationFailed` or `ZonalAllocationFailed` `Allocation failed. We do not have sufficient capacity for the requested VM size in this region. …`	No capacity for that size in that region or zone right now (create, start from deallocated, or resize). Apply Microsoft's alternative recommendation in the response (other sizes for the zone, other zones for the size), retry later, or try another region. For workloads that must start, use on-demand capacity reservations
`Allocation failed. If you are trying to add a new VM to a Virtual Machine Scale Set with a single placement group … the cluster is out of capacity. …`	A single placement group pins the scale set to one cluster. Reduce the instance count, use a scale set with multiple placement groups, or choose another size
Resize or start fails inside an availability set	Requests must land on the cluster already hosting the set. Stop (deallocate) all VMs in the set, then start them together so every cluster that offers the size is eligible
`AllocationFailed` `The VM allocation failed due to an internal error. Please retry later or try deploying to a different location.`	Transient: retry, or another region

Capacity isn't quota: a quota increase doesn't fix AllocationFailed.

Provisioning the OS

Code / message	Cause → fix
`OSProvisioningTimedOut` `OS Provisioning for VM '<vm>' did not finish in the allotted time. The VM may still finish provisioning successfully. …`	Check the VM's state before redeploying; for custom images, the image wasn't generalized (sysprep on Windows, deprovisioned on Linux) or was captured with the wrong create option
`OSProvisioningClientError` … `Make sure the image has been properly prepared (generalized).` / `SSH host key generation failed. …` / `Username specified for the VM is invalid for this Linux distribution. …`	Image not prepared, the Linux agent (or cloud-init) broken in the image, or a reserved user name
`InvalidParameter` `The Admin password specified is not allowed.` / `The supplied password must be between <n>-<n> characters long and must satisfy at least <n> of password complexity requirements …` / `The Admin Username specified is not allowed.`	Use a complex password (upper, lower, digit, special) or, on Linux, SSH keys; user names are at most 20 characters, can't end in `.`, and can't be one of a reserved list (`admin`, `administrator`, `root`, `guest`, `user`, `test`, `support` and others: Windows VM FAQ). Pass passwords from Key Vault, never in parameters files

Agent and extensions

Code / message	Cause → fix
`VMAgentStatusCommunicationError` `VM '<vm>' has not reported status for VM agent or extensions. Please verify the VM has a running VM agent, and can establish outbound connections to Azure storage.`	Agent stopped, or the VM has no outbound path. A likely cause in 2026 (the hub's reading): new virtual networks created with network API versions released after March 31, 2026 (and from the portal) default to private subnets without default outbound access, so give the subnet explicit egress (NAT gateway, firewall or public IP)
`VMExtensionProvisioningError` `VM has reported a failure when processing extension '<name>'. Error message: "<…>".` / `VMExtensionHandlerNonTransientError`	The extension itself failed (often a script's non-zero exit). Read the inner message: `az vm get-instance-view -g <rg> -n <vm> --query "instanceView.extensions[].{name:name, status:statuses[0].message}"`. Fix the script and re-apply; a failed extension also blocks other operations
`ArtifactNotFound` / `ArtifactVersionNotFound`	Wrong publisher, type or handler version for that region: `az vm extension image list -l <region> --publisher <publisher> -o table`

Operation conflicts and disks

Code / message	Cause → fix
`OperationNotAllowed` `Operation '<op>' is not allowed on VM '<vm>' since another operation is in progress.`	Wait for the running operation (deployments, extensions, backup) and retry
`OperationNotAllowed` `… since VM has extension '<name>' in failed state.`	Remove or fix the failed extension first
`OperationNotAllowed` `The maximum number of data disks allowed to be attached to a VM of this size is <n>.`	Resize to a size with more disk slots (a fixed per-size limit, from `az vm list-skus`)
`OperationNotAllowed` `Cannot modify extensions in the VM when the VM is not running.`	Start the VM first
`ConflictingUserInput` `Disk '<disk>' cannot be attached as the disk is already owned by VM '<vm>'.` / `AcquireDiskLeaseFailed`	The disk or VHD is attached elsewhere: detach it or use a copy

2026 defaults for new VMs

Trusted Launch (secure boot, vTPM) is the default for new Gen2 VMs and scale sets created from the portal, CLI and PowerShell. SDK and Terraform deployments get it after registering TrustedLaunchByDefaultPreview; images or features that don't support it need securityType set explicitly.
Private subnets by default: new virtual networks created with network API versions released after March 31, 2026 (and from the portal) get subnets with defaultOutboundAccess: false. Existing networks don't change. VMs there need explicit egress for agents, extensions, package downloads and Windows activation: reference/networking/outbound-connectivity.md.

Scale sets (Flexible vs Uniform, upgrades, repairs) and Compute Gallery images: reference/vm/scale-sets-and-images.md.