These errors say the subscription can't take the request as written: the provider isn't enabled, the size isn't offered there, the quota is used up, or the region is closed to you. Rewriting the template doesn't help; change the target (region, size, subscription) or the subscription's settings. Template and dependency errors are in reference/arm/deployment-errors.md; AuthorizationFailed is in reference/rbac/errors.md; RequestDisallowedByPolicy is in reference/policy/effects-and-errors.md.

Providers and subscription

Error	Cause → fix	Check
`MissingSubscriptionRegistration` `The subscription is not registered to use namespace {namespace}`	The resource provider isn't registered. Templates auto-register the providers they declare, but not supporting ones a resource creates (monitoring, security). Neither does Terraform `azurerm` v5, whose default is `resource_provider_registrations = none`. Register it: `az provider register --namespace <ns>`; registering needs `*/register/action` (Contributor, Owner)	`az provider show --namespace <ns> --query registrationState`
`NoRegisteredProviderFound` `No registered resource provider found for location {location} and API version {api-version} for type {resource-type}.`	Unregistered provider, or that API version or location isn't supported for the type. The message lists the supported ones	`az provider show --namespace <ns> --query "resourceTypes[?resourceType=='<type>'].{api:apiVersions[0:3], loc:locations}"`
`MissingRegistrationForLocation`	Registered, but not for that region: re-register after the provider adds regions	Same call → `locations`
`Registering` state	Registration runs region by region; don't block on it. Resources can be created in a region once it's done there	`az provider show --namespace <ns> --query registrationState`
`SubscriptionNotFound`	Wrong subscription ID, no access to it, or it's in another tenant	`az account list --query "[].{name:name, id:id, tenant:tenantId}" -o table`
`InvalidAuthenticationTokenTenant`	The token is from a different tenant than the subscription. Sign in to that tenant: `az login --tenant <tenant-id>`	`az account show --query tenantId` vs the subscription's tenant
AuthorizationFailed although your role is right	An unregistered provider can surface as `AuthorizationFailed` too (Microsoft lists it as a cause)	The provider check above

Size, quota, capacity and region

Error	Cause → fix	Check
`SkuNotAvailable` `The requested size for resource '<id>' is currently not available in location '<loc>' zones '<zones>' for subscription '<sub>'.` (inside `InvalidTemplateDeployment` when a template is validated)	That size isn't offered to this subscription in that region or zone, or Spot capacity is gone. Pick another size, zone or region; Support can open a restricted SKU	`az vm list-skus --location <loc> --size <prefix> --all --output table` (the `Restrictions` column)
`OperationNotAllowed` `Operation results in exceeding quota limits of Core. Maximum allowed: <n>, Current in use: <n>, Additional requested: <n>.`	A vCPU quota (subscription + region) would be exceeded. Free capacity or request an increase	`az vm list-usage --location <loc> -o table`
`ResourceQuotaExceeded` `Creating the resource of type <type> would exceed the quota of <n> resources of type <type> per resource group.`	A per-resource-group (or per-subscription) count limit. Delete some, or use another group	The message gives the count
`PublicIPCountLimitReached`	Public IP quota reached	`az network public-ip list --query "length(@)"`
`AllocationFailed`	The region or cluster has no capacity for that size right now. Retry later or choose another size	Retry, or another size in `vm list-skus`
`RegionDoesNotAllowProvisioning`; `The selected region is currently not accepting new customers: https://aka.ms/locationineligible`	Microsoft restricts some regions to customers who already have resources there. Use another region, or ask Support for region access	`az account list-locations -o table`; does any subscription in the tenant have resources there?

Don't type quota numbers into templates or docs: they differ per subscription. Read them live.

Throttling

Error	Cause → fix	Check
HTTP 429, `SubscriptionRequestsThrottled`	Resource Manager's token bucket is empty. It refills per region, per subscription, per service principal and per operation type: reads 250 burst / 25 per second, writes and deletes 200 / 10. Wait the `Retry-After` seconds; the SDKs retry on their own	The `x-ms-ratelimit-remaining-subscription-reads` / `-writes` / `-deletes` response headers
`The request for subscription '…' could not be processed due to an excessive volume of traffic. Please try again later.`	Background-job throttling: retry later	—
429 from a provider (Microsoft.Network, Compute, Key Vault)	Providers throttle separately (Network: 1,000 writes and 10,000 reads per 5 minutes). Some return 429 for a temporary resource state, not volume	The error body's provider name

Polling metrics through …/providers/microsoft.insights/metrics is a common cause of subscription throttling; batch it (getBatch). More in reference/arm/throttling-and-long-running-operations.md.

Names and locks

Error	Cause → fix	Check
`StorageAccountAlreadyTaken`, `StorageAccountAlreadyExists`, `DnsRecordInUse`	The name is globally unique and taken. Add `uniqueString(resourceGroup().id)` or similar	`az storage account check-name --name <n>`
`ReservedResourceName`	The name contains a reserved word	The message names it
`AccountNameInvalid` `<name> is not a valid storage account name. Storage account name must be between 3 and 24 characters in length and use numbers and lower-case letters only.`	Follow the rule in the message	—
`The scope '…' cannot perform delete operation because following scope(s) are locked: … Please remove the lock and try again.` (the `write` variant too; the code name `ScopeLocked` is the hub's reading)	A `ReadOnly` or `CanNotDelete` lock at this scope or above. `ReadOnly` also blocks POST operations such as storage `listKeys`, VM start and App Service plan scaling	`az lock list --resource-group <rg> -o table` (`reference/arm/locks-and-tags.md`)

When none of these fits

Get the full error with az deployment operation group list --resource-group <rg> --name <deployment> --query "[?properties.provisioningState=='Failed'].properties.statusMessage" (guides/arm/debug-failed-deployment.md). For an unknown code, the full table is Microsoft's "common deployment errors" page.