---
cuppy_hub: azure
cuppy_path: reference/arm/errors.md
cuppy_section: docs
cuppy_doc: ME2A-B3R1
cuppy_doc_uuid: 84ea0454-7660-413d-8408-66da397f7316
cuppy_permalink: https://cuppy.io/azure/d/ME2A-B3R1
cuppy_version: 1
cuppy_updated: 2026-10-23T16:16:52.575Z
cuppy_canonical: https://cuppy.io/azure/docs/reference/arm/errors
cuppy_mcp: https://cuppy.io/mcp
cuppy_body_sha256: 2318edb22f685408bdbbb7027ee121ada60448a57d279f741d79ae90bf5a3e92
# cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks.
---


# Azure Resource Manager errors — subscription, provider, quota, SKU and region

**These errors say the subscription can't take the request as written: the provider isn't enabled, the size isn't offered there, the quota is used up, or the region is closed to you.** Rewriting the template doesn't help; change the target (region, size, subscription) or the subscription's settings. Template and dependency errors are in `reference/arm/deployment-errors.md`; `AuthorizationFailed` is in `reference/rbac/errors.md`; `RequestDisallowedByPolicy` is in `reference/policy/effects-and-errors.md`.

## Providers and subscription

| Error | Cause → fix | Check |
|---|---|---|
| `MissingSubscriptionRegistration` `The subscription is not registered to use namespace {namespace}` | The resource provider isn't registered. Templates auto-register the providers they declare, but **not** supporting ones a resource creates (monitoring, security). Neither does Terraform `azurerm` v5, whose default is `resource_provider_registrations = none`. Register it: `az provider register --namespace <ns>`; registering needs `*/register/action` (Contributor, Owner) | `az provider show --namespace <ns> --query registrationState` |
| `NoRegisteredProviderFound` `No registered resource provider found for location {location} and API version {api-version} for type {resource-type}.` | Unregistered provider, **or** that API version or location isn't supported for the type. The message lists the supported ones | `az provider show --namespace <ns> --query "resourceTypes[?resourceType=='<type>'].{api:apiVersions[0:3], loc:locations}"` |
| `MissingRegistrationForLocation` | Registered, but not for that region: re-register after the provider adds regions | Same call → `locations` |
| `Registering` state | Registration runs region by region; don't block on it. Resources can be created in a region once it's done there | `az provider show --namespace <ns> --query registrationState` |
| `SubscriptionNotFound` | Wrong subscription ID, no access to it, or it's in another tenant | `az account list --query "[].{name:name, id:id, tenant:tenantId}" -o table` |
| `InvalidAuthenticationTokenTenant` | The token is from a different tenant than the subscription. Sign in to that tenant: `az login --tenant <tenant-id>` | `az account show --query tenantId` vs the subscription's tenant |
| AuthorizationFailed although your role is right | An unregistered provider can surface as `AuthorizationFailed` too (Microsoft lists it as a cause) | The provider check above |

## Size, quota, capacity and region

| Error | Cause → fix | Check |
|---|---|---|
| `SkuNotAvailable` `The requested size for resource '<id>' is currently not available in location '<loc>' zones '<zones>' for subscription '<sub>'.` (inside `InvalidTemplateDeployment` when a template is validated) | That size isn't offered to this subscription in that region or zone, or Spot capacity is gone. Pick another size, zone or region; Support can open a restricted SKU | `az vm list-skus --location <loc> --size <prefix> --all --output table` (the `Restrictions` column) |
| `OperationNotAllowed` `Operation results in exceeding quota limits of Core. Maximum allowed: <n>, Current in use: <n>, Additional requested: <n>.` | A vCPU quota (subscription + region) would be exceeded. Free capacity or request an increase | `az vm list-usage --location <loc> -o table` |
| `ResourceQuotaExceeded` `Creating the resource of type <type> would exceed the quota of <n> resources of type <type> per resource group.` | A per-resource-group (or per-subscription) count limit. Delete some, or use another group | The message gives the count |
| `PublicIPCountLimitReached` | Public IP quota reached | `az network public-ip list --query "length(@)"` |
| `AllocationFailed` | The region or cluster has no capacity for that size right now. Retry later or choose another size | Retry, or another size in `vm list-skus` |
| `RegionDoesNotAllowProvisioning`; `The selected region is currently not accepting new customers: https://aka.ms/locationineligible` | Microsoft restricts some regions to customers who already have resources there. Use another region, or ask Support for region access | `az account list-locations -o table`; does any subscription in the tenant have resources there? |

Don't type quota numbers into templates or docs: they differ per subscription. Read them live.

## Throttling

| Error | Cause → fix | Check |
|---|---|---|
| HTTP 429, `SubscriptionRequestsThrottled` | Resource Manager's token bucket is empty. It refills per region, per subscription, per service principal and per operation type: reads 250 burst / 25 per second, writes and deletes 200 / 10. Wait the `Retry-After` seconds; the SDKs retry on their own | The `x-ms-ratelimit-remaining-subscription-reads` / `-writes` / `-deletes` response headers |
| `The request for subscription '…' could not be processed due to an excessive volume of traffic. Please try again later.` | Background-job throttling: retry later | — |
| 429 from a provider (Microsoft.Network, Compute, Key Vault) | Providers throttle separately (Network: 1,000 writes and 10,000 reads per 5 minutes). Some return 429 for a temporary resource state, not volume | The error body's provider name |

Polling metrics through `…/providers/microsoft.insights/metrics` is a common cause of subscription throttling; batch it (`getBatch`). More in `reference/arm/throttling-and-long-running-operations.md`.

## Names and locks

| Error | Cause → fix | Check |
|---|---|---|
| `StorageAccountAlreadyTaken`, `StorageAccountAlreadyExists`, `DnsRecordInUse` | The name is globally unique and taken. Add `uniqueString(resourceGroup().id)` or similar | `az storage account check-name --name <n>` |
| `ReservedResourceName` | The name contains a reserved word | The message names it |
| `AccountNameInvalid` `<name> is not a valid storage account name. Storage account name must be between 3 and 24 characters in length and use numbers and lower-case letters only.` | Follow the rule in the message | — |
| `The scope '…' cannot perform delete operation because following scope(s) are locked: … Please remove the lock and try again.` (the `write` variant too; the code name `ScopeLocked` is the hub's reading) | A `ReadOnly` or `CanNotDelete` lock at this scope or above. `ReadOnly` also blocks POST operations such as storage `listKeys`, VM start and App Service plan scaling | `az lock list --resource-group <rg> -o table` (`reference/arm/locks-and-tags.md`) |

## When none of these fits

Get the full error with `az deployment operation group list --resource-group <rg> --name <deployment> --query "[?properties.provisioningState=='Failed'].properties.statusMessage"` (`guides/arm/debug-failed-deployment.md`). For an unknown code, the full table is Microsoft's "common deployment errors" page.


---
<!-- cuppy -->
You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.
<!-- /cuppy -->