--- cuppy_hub: azure cuppy_path: reference/vm/errors.md cuppy_section: docs cuppy_doc: W18V-PE0C cuppy_doc_uuid: b92a5169-61dd-4de5-b2cc-91dead35e6ce cuppy_permalink: https://cuppy.io/azure/d/W18V-PE0C cuppy_version: 1 cuppy_updated: 2026-10-23T16:16:52.575Z cuppy_canonical: https://cuppy.io/azure/docs/reference/vm/errors cuppy_mcp: https://cuppy.io/mcp cuppy_body_sha256: 24e4b93f0f835d88c23047ef21a17dfa0da4d880e81776625e1cfcbad012b817 # cuppy_body_sha256 is over the document body ALONE, excluding both generated blocks. --- # Virtual machine errors VM errors arrive as Resource Manager errors (often wrapped in `DeploymentFailed`: `guides/arm/debug-failed-deployment.md`). **SKU not offered in a region or zone (`SkuNotAvailable`) and core quota (`OperationNotAllowed … exceeding quota limits of Core`)** are in `reference/arm/errors.md`; read live values with `az vm list-skus -l --size --all -o table` and `az vm list-usage -l -o table`. This page covers the rest. ## Allocation (capacity at the moment of the request) | Code / message | Cause → fix | |---|---| | `AllocationFailed` or `ZonalAllocationFailed` `Allocation failed. We do not have sufficient capacity for the requested VM size in this region. …` | No capacity for that size in that region or zone right now (create, start from deallocated, or resize). Apply Microsoft's **alternative recommendation** in the response (other sizes for the zone, other zones for the size), retry later, or try another region. For workloads that must start, use **on-demand capacity reservations** | | `Allocation failed. If you are trying to add a new VM to a Virtual Machine Scale Set with a single placement group … the cluster is out of capacity. …` | A single placement group pins the scale set to one cluster. Reduce the instance count, use a scale set with multiple placement groups, or choose another size | | Resize or start fails inside an **availability set** | Requests must land on the cluster already hosting the set. Stop (deallocate) **all** VMs in the set, then start them together so every cluster that offers the size is eligible | | `AllocationFailed` `The VM allocation failed due to an internal error. Please retry later or try deploying to a different location.` | Transient: retry, or another region | Capacity isn't quota: a quota increase doesn't fix `AllocationFailed`. ## Provisioning the OS | Code / message | Cause → fix | |---|---| | `OSProvisioningTimedOut` `OS Provisioning for VM '' did not finish in the allotted time. The VM may still finish provisioning successfully. …` | Check the VM's state before redeploying; for custom images, the image wasn't generalized (sysprep on Windows, deprovisioned on Linux) or was captured with the wrong create option | | `OSProvisioningClientError` … `Make sure the image has been properly prepared (generalized).` / `SSH host key generation failed. …` / `Username specified for the VM is invalid for this Linux distribution. …` | Image not prepared, the Linux agent (or cloud-init) broken in the image, or a reserved user name | | `InvalidParameter` `The Admin password specified is not allowed.` / `The supplied password must be between - characters long and must satisfy at least of password complexity requirements …` / `The Admin Username specified is not allowed.` | Use a complex password (upper, lower, digit, special) or, on Linux, SSH keys; user names are at most 20 characters, can't end in `.`, and can't be one of a reserved list (`admin`, `administrator`, `root`, `guest`, `user`, `test`, `support` and others: Windows VM FAQ). Pass passwords from Key Vault, never in parameters files | ## Agent and extensions | Code / message | Cause → fix | |---|---| | `VMAgentStatusCommunicationError` `VM '' has not reported status for VM agent or extensions. Please verify the VM has a running VM agent, and can establish outbound connections to Azure storage.` | Agent stopped, or the VM has no outbound path. A likely cause in 2026 (the hub's reading): new virtual networks created with network API versions released after March 31, 2026 (and from the portal) default to **private subnets without default outbound access**, so give the subnet explicit egress (NAT gateway, firewall or public IP) | | `VMExtensionProvisioningError` `VM has reported a failure when processing extension ''. Error message: "<…>".` / `VMExtensionHandlerNonTransientError` | The extension itself failed (often a script's non-zero exit). Read the inner message: `az vm get-instance-view -g -n --query "instanceView.extensions[].{name:name, status:statuses[0].message}"`. Fix the script and re-apply; a failed extension also blocks other operations | | `ArtifactNotFound` / `ArtifactVersionNotFound` | Wrong publisher, type or handler version for that region: `az vm extension image list -l --publisher -o table` | ## Operation conflicts and disks | Code / message | Cause → fix | |---|---| | `OperationNotAllowed` `Operation '' is not allowed on VM '' since another operation is in progress.` | Wait for the running operation (deployments, extensions, backup) and retry | | `OperationNotAllowed` `… since VM has extension '' in failed state.` | Remove or fix the failed extension first | | `OperationNotAllowed` `The maximum number of data disks allowed to be attached to a VM of this size is .` | Resize to a size with more disk slots (a fixed per-size limit, from `az vm list-skus`) | | `OperationNotAllowed` `Cannot modify extensions in the VM when the VM is not running.` | Start the VM first | | `ConflictingUserInput` `Disk '' cannot be attached as the disk is already owned by VM ''.` / `AcquireDiskLeaseFailed` | The disk or VHD is attached elsewhere: detach it or use a copy | ## 2026 defaults for new VMs - **Trusted Launch** (secure boot, vTPM) is the default for new Gen2 VMs and scale sets created from the portal, CLI and PowerShell. SDK and Terraform deployments get it after registering `TrustedLaunchByDefaultPreview`; images or features that don't support it need `securityType` set explicitly. - **Private subnets by default:** new virtual networks created with network API versions released after March 31, 2026 (and from the portal) get subnets with `defaultOutboundAccess: false`. Existing networks don't change. VMs there need explicit egress for agents, extensions, package downloads and Windows activation: `reference/networking/outbound-connectivity.md`. Scale sets (Flexible vs Uniform, upgrades, repairs) and Compute Gallery images: `reference/vm/scale-sets-and-images.md`. --- You are reading one file. The same content is free over MCP at https://cuppy.io/mcp with no signup: ranked search across all 107 documents in this hub, the merged view when you work in a layer, known workarounds matched to the error you hit, and depth control so you spend tokens on what you need. Start with the `_hello` tool. How to connect: https://cuppy.io/azure/ Something wrong in this document? Report it with the `session feedback` tool on the same endpoint.