quotas

Azure compute quotas of a region

Returns, for each compute quota of an Azure subscription in one region (the vCPUs of the region and of each family of machines, among others), what is in use, its limit and the part of the limit in use, read through Azure Resource Manager with a service principal that may only read. A quota reached refuses the next machine, the next resize or the next node of a cluster that scales out. One watch is offered, set on the probe.

Versions

Generic: Azure Resource Manager is one service, the same for every subscription. The collector asks for the API version 2024-07-01 of Microsoft.Compute, listed by the Azure REST API reference among the supported versions of "Usage - List".

How it works

1. POST https://login.microsoftonline.com/<azure:tenant>/oauth2/v2.0/token, the form grant_type=client_credentials&client_id=…&client_secret=…&scope=https://management.azure.com/.default: an access token, kept thirty minutes in the probe's cache, encrypted on the poller. A token Azure no longer takes answers 401, and the collector logs in again, once.
2. GET https://management.azure.com/subscriptions/<azure:subscription>/providers/Microsoft.Compute/locations/<azure:region>/usages?api-version=2024-07-01, the token as Authorization: Bearer, page after page by nextLink.

{"value": [{"unit": "Count", "currentValue": 17, "limit": 20, "name": {"value": "cores", "localizedValue": "Total Regional vCPUs"}}, {"unit": "Count", "currentValue": 8, "limit": 10, "name": {"value": "standardDSv3Family", "localizedValue": "Standard DSv3 Family vCPUs"}}]}

• A quota is named by name.value (cores, virtualMachines, standardDSv3Family), which does not change with the language of the account.
• usage is currentValue, limit is limit, and used is usage × 100 / limit, to the tenth. A quota whose limit is 0 (a family the subscription may not use) has no used.
• An empty list (a region misspelt) stops the collector misconfigured.
• A next page is only followed on https://management.azure.com/, where the token may go; any other address stops the collector unreachable.
• A code 400 or 401 on the login stops the collector misconfigured (the tenant, the client or its secret refused); a code 403 on the list (the role missing), 400 or 404 (the subscription or the region unknown) too; any other code but 200 stops it unreachable.

The client secret comes from protocol:http:password, a secret variable: it goes in the body of the login only, to https:// only. The token is a secret too, kept in the cache and sent in a header. The quotas are not secret.

Prerequisites

• A service principal: an app registration in Microsoft Entra ID with a client secret. Its application (client) ID goes in protocol:http:user, its secret in protocol:http:password, its tenant in the variable azure:tenant.
• The role Reader given to it on the subscription: */read and nothing else. With Azure CLI: az role assignment create --assignee <client id> --role Reader --scope /subscriptions/<subscription id>.
• The poller reaches login.microsoftonline.com and management.azure.com in HTTPS. Their certificates are issued by public authorities: the profile "Standard" trusts them.

Variables

Outputs

Watches

Limits

• One region per probe; the quotas of the subscription in another region need another probe.
• The compute quotas only: those of networking (public addresses) and storage have their own routes, not read here.
• Not checked against an Azure subscription: the route and fields are those of the Azure REST API reference (learn.microsoft.com: "Usage - List", read in 2026-04-01, the version 2024-07-01 listed among those supported) and of the Microsoft identity platform ("OAuth 2.0 client credentials flow"). The names given above as examples of name.value are not taken from the reference, whose sample has none.