{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "slug": "dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope", "url": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/" }, "title": "Budget Azure Compute API traffic at both resource and subscription scope", "summary": "Why can a VM automation job receive throttling even when no individual machine appears unusually busy?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "network-infrastructure", "label": "Networks & infrastructure", "alt": "Resilient network core with engineered blue and gold data paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "slug": "networks-infrastructure", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-10T00:31:19+00:00", "modified_at": "2026-09-10T00:32:00+00:00", "reviewed_on": "2026-09-09", "reading_minutes": 2, "word_count": 234, "potentially_affected": "Teams automating Azure Compute operations on VMs and virtual machine scale sets.", "dse_recommendation": "Classify the automation's Compute operations and account for aggregate request traffic before increasing concurrency.", "primary_source": { "name": "Compute throttling limits - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

Azure Compute throttling applies per region and returns HTTP 429 when requests exceed applicable limits. Policies can constrain an individual resource and the subscription’s aggregate traffic, so staying below each VM’s limit does not establish subscription-level headroom. Compute uses token buckets with a maximum capacity and a replenishment rate. Responses expose remaining-resource rate-limit information through x-ms-ratelimit-remaining-resource. Microsoft Learn.

\n

Applicability

\n

Review an identified automation job, its target subscription and region, and the exact operations it issues. Include its polling and extension-management calls in the traffic inventory. Select the source table for VMs, scale sets, or scale-set instances rather than treating every Compute operation as equivalent.

\n

DSE recommendation

\n

Classify the automation’s Compute operations and account for aggregate request traffic before increasing concurrency. Ask other automation owners to identify concurrent jobs using the same operation policies. Set a deliberate request budget and an observable response to throttling. Keep a short initial burst separate from the workload’s sustained request rate when evaluating a proposed schedule.

\n

Verification

\n

Run a bounded trial and capture operation categories, request timing, response headers, and any 429 results. Compare single-resource traffic with the combined subscription-region activity. Adjust the approved budget using those observations instead of assuming that adding workers will shorten completion time. Retain the policy-table revision and test conditions so a later change in workload volume can be reviewed against the same evidence.

\n

Official references

\n

Microsoft Learn: Compute throttling limits. Source reviewed September 9, 2026.

", "content_text": "Source facts\nAzure Compute throttling applies per region and returns HTTP 429 when requests exceed applicable limits. Policies can constrain an individual resource and the subscription’s aggregate traffic, so staying below each VM’s limit does not establish subscription-level headroom. Compute uses token buckets with a maximum capacity and a replenishment rate. Responses expose remaining-resource rate-limit information through x-ms-ratelimit-remaining-resource. Microsoft Learn.\nApplicability\nReview an identified automation job, its target subscription and region, and the exact operations it issues. Include its polling and extension-management calls in the traffic inventory. Select the source table for VMs, scale sets, or scale-set instances rather than treating every Compute operation as equivalent.\nDSE recommendation\nClassify the automation’s Compute operations and account for aggregate request traffic before increasing concurrency. Ask other automation owners to identify concurrent jobs using the same operation policies. Set a deliberate request budget and an observable response to throttling. Keep a short initial burst separate from the workload’s sustained request rate when evaluating a proposed schedule.\nVerification\nRun a bounded trial and capture operation categories, request timing, response headers, and any 429 results. Compare single-resource traffic with the combined subscription-region activity. Adjust the approved budget using those observations instead of assuming that adding workers will shorten completion time. Retain the policy-table revision and test conditions so a later change in workload volume can be reviewed against the same evidence.\nOfficial references\nMicrosoft Learn: Compute throttling limits. Source reviewed September 9, 2026.", "content_markdown": "## Source facts\n\nAzure Compute throttling applies per region and returns HTTP 429 when requests exceed applicable limits. Policies can constrain an individual resource and the subscription’s aggregate traffic, so staying below each VM’s limit does not establish subscription-level headroom. Compute uses token buckets with a maximum capacity and a replenishment rate. Responses expose remaining-resource rate-limit information through x-ms-ratelimit-remaining-resource. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits).\n\n## Applicability\n\nReview an identified automation job, its target subscription and region, and the exact operations it issues. Include its polling and extension-management calls in the traffic inventory. Select the source table for VMs, scale sets, or scale-set instances rather than treating every Compute operation as equivalent.\n\n## DSE recommendation\n\nClassify the automation’s Compute operations and account for aggregate request traffic before increasing concurrency. Ask other automation owners to identify concurrent jobs using the same operation policies. Set a deliberate request budget and an observable response to throttling. Keep a short initial burst separate from the workload’s sustained request rate when evaluating a proposed schedule.\n\n## Verification\n\nRun a bounded trial and capture operation categories, request timing, response headers, and any 429 results. Compare single-resource traffic with the combined subscription-region activity. Adjust the approved budget using those observations instead of assuming that adding workers will shorten completion time. Retain the policy-table revision and test conditions so a later change in workload volume can be reviewed against the same evidence.\n\n## Official references\n\n[Microsoft Learn: Compute throttling limits](https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits). Source reviewed September 9, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-09" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Budget Azure Compute API traffic at both resource and subscription scope", "item": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "url": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/", "headline": "Budget Azure Compute API traffic at both resource and subscription scope", "description": "Why can a VM automation job receive throttling even when no individual machine appears unusually busy?", "abstract": "Why can a VM automation job receive throttling even when no individual machine appears unusually busy?", "articleBody": "Source facts\nAzure Compute throttling applies per region and returns HTTP 429 when requests exceed applicable limits. Policies can constrain an individual resource and the subscription’s aggregate traffic, so staying below each VM’s limit does not establish subscription-level headroom. Compute uses token buckets with a maximum capacity and a replenishment rate. Responses expose remaining-resource rate-limit information through x-ms-ratelimit-remaining-resource. Microsoft Learn.\nApplicability\nReview an identified automation job, its target subscription and region, and the exact operations it issues. Include its polling and extension-management calls in the traffic inventory. Select the source table for VMs, scale sets, or scale-set instances rather than treating every Compute operation as equivalent.\nDSE recommendation\nClassify the automation’s Compute operations and account for aggregate request traffic before increasing concurrency. Ask other automation owners to identify concurrent jobs using the same operation policies. Set a deliberate request budget and an observable response to throttling. Keep a short initial burst separate from the workload’s sustained request rate when evaluating a proposed schedule.\nVerification\nRun a bounded trial and capture operation categories, request timing, response headers, and any 429 results. Compare single-resource traffic with the combined subscription-region activity. Adjust the approved budget using those observations instead of assuming that adding workers will shorten completion time. Retain the policy-table revision and test conditions so a later change in workload volume can be reviewed against the same evidence.\nOfficial references\nMicrosoft Learn: Compute throttling limits. Source reviewed September 9, 2026.", "datePublished": "2026-09-10T00:31:19+00:00", "dateModified": "2026-09-10T00:32:00+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/network-infrastructure-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Budget Azure Compute API traffic at both resource and subscription scope" }, "articleSection": [ "IT", "Networks & Infrastructure" ], "keywords": [ "IT", "Networks & Infrastructure", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" }, { "@type": "Thing", "name": "Networks & Infrastructure", "url": "https://update.dsesecurity.com/topic/networks-infrastructure/" } ], "wordCount": 234, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Compute throttling limits - Azure Virtual Machines | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits" } } ] } }