# Budget Azure Compute API traffic at both resource and subscription scope

> Why can a VM automation job receive throttling even when no individual machine appears unusually busy?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:31:19+00:00
- Modified: 2026-09-10T00:32:00+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: IT, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Why can a VM automation job receive throttling even when no individual machine appears unusually busy?

## Potentially affected

Teams automating Azure Compute operations on VMs and virtual machine scale sets.

## DSE recommendation

Classify the automation's Compute operations and account for aggregate request traffic before increasing concurrency.

## Article

## Source facts

Azure Compute throttling applies per region and returns HTTP 429 when requests exceed applicable limits. Policies can constrain an individual resource and the subscription’s aggregate traffic, so staying below each VM’s limit does not establish subscription-level headroom. Compute uses token buckets with a maximum capacity and a replenishment rate. Responses expose remaining-resource rate-limit information through x-ms-ratelimit-remaining-resource. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits).

## Applicability

Review an identified automation job, its target subscription and region, and the exact operations it issues. Include its polling and extension-management calls in the traffic inventory. Select the source table for VMs, scale sets, or scale-set instances rather than treating every Compute operation as equivalent.

## DSE recommendation

Classify the automation’s Compute operations and account for aggregate request traffic before increasing concurrency. Ask other automation owners to identify concurrent jobs using the same operation policies. Set a deliberate request budget and an observable response to throttling. Keep a short initial burst separate from the workload’s sustained request rate when evaluating a proposed schedule.

## Verification

Run a bounded trial and capture operation categories, request timing, response headers, and any 429 results. Compare single-resource traffic with the combined subscription-region activity. Adjust the approved budget using those observations instead of assuming that adding workers will shorten completion time. Retain the policy-table revision and test conditions so a later change in workload volume can be reviewed against the same evidence.

## Official references

[Microsoft Learn: Compute throttling limits](https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits). Source reviewed September 9, 2026.

## Primary reference

- Name: Compute throttling limits - Azure Virtual Machines | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/virtual-machines/compute-throttling-limits
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Budget Azure Compute API traffic at both resource and subscription scope,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-037-budget-azure-compute-api-traffic-at-both-resource-and-subscription-scope/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.