Azure subscription limits and quotas - Azure Resource Manager (2024)

This document lists some of the most common Microsoft Azure limits, which are also sometimes called quotas.

To learn more about Azure pricing, see Azure pricing overview. There, you can estimate your costs by using the pricing calculator. You also can go to the pricing details page for a particular service, for example, Windows VMs. For tips to help manage your costs, see Prevent unexpected costs with Azure billing and cost management.

Managing limits

Free Trial subscriptions aren't eligible for limit or quota increases. If you have a Free Trial subscription, you can upgrade to a Pay-As-You-Go subscription. For more information, see Upgrade your Azure Free Trial subscription to a Pay-As-You-Go subscription and the Free Trial subscription FAQ.

Some limits are managed at a regional level.

Let's use vCPU quotas as an example. To request a quota increase with support for vCPUs, you must decide how many vCPUs you want to use in which regions. You then request an increase in vCPU quotas for the amounts and regions that you want. If you need to use 30 vCPUs in West Europe to run your application there, you specifically request 30 vCPUs in West Europe. Your vCPU quota isn't increased in any other region--only West Europe has the 30-vCPU quota.

As a result, decide what your quotas must be for your workload in any one region. Then request that amount in each region into which you want to deploy. For help in how to determine your current quotas for specific regions, see Resolve errors for resource quotas.

General limits

For limits on resource names, see Naming rules and restrictions for Azure resources.

For information about Resource Manager API read and write limits, see Throttling Resource Manager requests.

Management group limits

The following limits apply to management groups.

¹The 6 levels don't include the subscription level.

²If you reach the limit of 800 deployments, delete deployments from the history that are no longer needed. To delete management group level deployments, use Remove-AzManagementGroupDeployment or az deployment mg delete.

Subscription limits

The following limits apply when you use Azure Resource Manager and Azure resource groups.

¹You can apply up to 50 tags directly to a subscription. Within the subscription, each resource or resource group is also limited to 50 tags. However, the subscription can contain an unlimited number of tags that are dispersed across resources and resource groups.

²Resource Manager returns a list of tag name and values in the subscription only when the number of unique tags is 80,000 or less. A unique tag is defined by the combination of resource ID, tag name, and tag value. For example, two resources with the same tag name and value would be calculated as two unique tags. You still can find a resource by tag when the number exceeds 80,000.

³Deployments are automatically deleted from the history as you near the limit. For more information, see Automatic deletions from deployment history.

Resource group limits

¹Deployments are automatically deleted from the history as you near the limit. Deleting an entry from the deployment history doesn't affect the deployed resources. For more information, see Automatic deletions from deployment history.

Template limits

You can exceed some template limits by using a nested template. For more information, see Use linked templates when you deploy Azure resources. To reduce the number of parameters, variables, or outputs, you can combine several values into an object. For more information, see Objects as parameters.

You may get an error with a template or parameter file of less than 4 MB, if the total size of the request is too large. For more information about how to simplify your template to avoid a large request, see Resolve errors for job size exceeded.

Microsoft Entra ID limits

Here are the usage constraints and other service limits for the Microsoft Entra service.

API Center limits

¹ To increase a limit in the Standard plan, contact support.
² In the Free plan, use of full service features including API analysis and access through the data plane API is limited to 5 APIs.
³ Custom metadata properties assigned to APIs, deployments, and environments.

API Management limits

This section provides information about limits that apply to Azure API Management instances in different service tiers, including the following:

• API Management classic tiers
• API Management v2 tiers
• Developer portal in API Management v2 tiers

Limits - API Management classic tiers

For certain API Management resources, limits are set only in the Consumption tier; in other API Management classic tiers, where indicated, these resources are unlimited. However, your practical upper limit depends on service configuration including pricing tier, service capacity, number of scale units, policy configuration, API definitions and types, number of concurrent requests, and other factors.

To request a limit increase, create a support request from the Azure portal. For more information, see Azure support plans.

¹ Connections are pooled and reused unless explicitly closed by the backend.
² Includes an up to 2048-bytes long query string.
³ The number of nodes (or replicas) associated with a self-hosted gateway resource is unlimited in the Premium tier and capped at a single node in the Developer tier.
⁴ Up to a maximum of 60,000 connections per service instance.

Limits - API Management v2 tiers

To request a limit increase, create a support request from the Azure portal. For more information, see Azure support plans.

¹ Connections are pooled and reused unless explicitly closed by the backend.
² Includes an up to 2048-bytes long query string.
³ Up to a maximum of 60,000 connections per service instance.

Limits - Developer portal in API Management v2 tiers

¹ Limit for built-in widgets such as text, images, or APIs list. Currently, custom widgets and custom HTML code widgets aren't supported in the v2 tiers.

App Service limits

¹ Apps and storage quotas are per App Service plan unless noted otherwise.

² The actual number of apps that you can host on these machines depends on the activity of the apps, the size of the machine instances, and the corresponding resource utilization.

³ Dedicated instances can be of different sizes. For more information, see App Service pricing.

⁴ More are allowed upon request.

⁵ The storage limit is the total content size across all apps in the same App service plan. The total content size of all apps across all App service plans in a single resource group and region cannot exceed 500 GB. The file system quota for App Service hosted apps is determined by the aggregate of App Service plans created in a region and resource group.

⁶ These resources are constrained by physical resources on the dedicated instances (the instance size and the number of instances).

⁷If you scale a Windows app in the Basic tier to two instances, you have 350 concurrent connections for each of the two instances. For Windows apps on Standard tier and above, there are no theoretical limits to WebSockets, but other factors can limit the number of WebSockets. For example, maximum concurrent requests allowed (defined by maxConcurrentRequestsPerCpu) are: 7,500 per small VM, 15,000 per medium VM (7,500 x 2 cores), and 75,000 per large VM (18,750 x 4 cores). Linux apps are limited 5 concurrent WebSocket connections on Free SKU and ~50k concurrent WebSocket connections per instance on all other SKUs.

⁸ The maximum IP connections are per instance and depend on the instance size: 1,920 per B1/S1/P1V3 instance, 3,968 per B2/S2/P2V3 instance, 8,064 per B3/S3/P3V3 instance.

⁹ App Service Isolated SKUs can be internally load balanced (ILB) with Azure Load Balancer, so there's no public connectivity from the internet. As a result, some features of an ILB Isolated App Service must be used from machines that have direct access to the ILB network endpoint.

¹⁰ Run custom executables and/or scripts on demand, on a schedule, or continuously as a background task within your App Service instance. Always On is required for continuous WebJobs execution. There's no predefined limit on the number of WebJobs that can run in an App Service instance. There are practical limits that depend on what the application code is trying to do.

¹¹ Only issuing standard certificates (wildcard certificates aren't available). Limited to only one free certificate per custom domain.

¹² Total storage usage across all apps deployed in a single App Service Environment (regardless of how they're allocated across different resource groups).

Automation limits

Process automation

¹A sandbox is a shared environment that can be used by multiple jobs. Jobs that use the same sandbox are bound by the resource limitations of the sandbox.
²To request a limit increase, create an Azure Support request. Free subscriptions including Azure Free Account and Azure for Students aren't eligible for limit or quota increases. If you have a free subscription, you can upgrade to Pay-As-You-Go subscription.

Change Tracking and Inventory

The following table shows the tracked item limits per machine for change tracking.

Update Management

The following table shows the limits for Update Management.

Azure App Configuration

Azure Cache for Redis limits

Azure Cache for Redis limits and sizes are different for each pricing tier. To see the pricing tiers and their associated sizes, see Azure Cache for Redis pricing.

For more information on Azure Cache for Redis configuration limits, see Default Redis server configuration.

Because configuration and management of Azure Cache for Redis instances is done by Microsoft, not all Redis commands are supported in Azure Cache for Redis. For more information, see Redis commands not supported in Azure Cache for Redis.

Azure Cloud Services limits

¹Each Azure Cloud Service with web or worker roles can have two deployments, one for production and one for staging. This limit refers to the number of distinct roles, that is, configuration. This limit doesn't refer to the number of instances per role, that is, scaling.

Azure AI Search limits

Pricing tiers determine the capacity and limits of your search service. Tiers include:

• Free multitenant service, shared with other Azure subscribers, is intended for evaluation and small development projects.
• Basic provides dedicated computing resources for production workloads at a smaller scale, with up to three replicas for highly available query workloads.
• Standard, which includes S1, S2, S3, and S3 High Density, is for larger production workloads. Multiple levels exist within the Standard tier so that you can choose a resource configuration that best matches your workload profile.

Limits per subscription

You can create multiple billable search services (Basic and higher), up to the maximum number of services allowed at each tier. For example, you could create up to 16 services at the Basic tier and another 16 services at the S1 tier within the same subscription. For more information about tiers, see Choose a tier (or SKU) for Azure AI Search.

Maximum service limits can be raised upon request. If you need more services within the same subscription, file a support request.

¹ You can have one free search service per Azure subscription. The free tier is based on infrastructure shared with other customers. Because the hardware isn't dedicated, scale-up isn't supported, and storage is limited to 50 MB.

² Search units (SU) are billing units, allocated as either a replica or a partition. You need both. To learn more about SU combinations, see Estimate and manage capacity of a search service.

Limits per search service

Search service limits for storage, partitions, and replicas vary by service creation date, with higher limits for newer services in supported regions. Limits vary by service creation date:

• Before April 3, 2024
• Between April and May 2024 (Basic, S1, S2, S3, S3 HD)
• After May 17, 2024 (L1 and L2)

A search service is subject to a maximum storage limit (partition size multiplied by the number of partitions) or by a hard limit on the maximum number of indexes or indexers, whichever comes first.

Service level agreements (SLAs) apply to billable services having two or more replicas for query workloads, or three or more replicas for query and indexing workloads. The number of partitions isn't an SLA consideration. For more information, see Reliability in Azure AI Search.

Free services don't have fixed partitions or replicas and they share resources with other subscribers.

Before April 3, 2024

After April 3, 2024

• Basic tier supports three partitions and three replicas, for a total of nine search units (SU). It also has larger partitions.
• S1, S2, S3, and S3 HD have larger partitions, ranging from 3-7 times more, depending on the tier.
• Higher capacity is limited to new search services in supported regions. There is no in-place upgrade at this time.

After May 17, 2024

• L1 and L2 have more partition storage and compute power.
• Higher capacity is limited to new search services in supported regions. There is no in-place upgrade at this time.

Supported regions with higher storage limits

Services must be in one of the following regions to get the extra storage. Watch for announcements in What's New in Azure AI Search for expansion to other regions.

Available starting on May 17, 2024

Available starting on April 3, 2024

To learn more about limits on a more granular level, such as document size, queries per second, keys, requests, and responses, see Service limits in Azure AI Search.

Azure AI services limits

The following limits are for the number of Azure AI services resources per Azure subscription.There is a limit of only one allowed 'Free' account, per resource type, per subscription.Each of the Azure AI services may have other limitations, for more information, see Azure AI services.

Azure Chaos Studio limits

For Azure Chaos Studio limits, see Azure Chaos Studio service limits.

Azure Communications Gateway limits

Some of the following default limits and quotas can be increased. To request a change, create a change request stating the limit you want to change.

The following restrictions apply to all Azure Communications Gateways:

• All traffic must use IPv4.
• All traffic must use TLS 1.2 or greater. Earlier versions aren't supported.
• The number of active calls is limited to 15% of the number of users assigned to Azure Communications Gateway. For the definition of users, see Plan and manage costs for Azure Communications Gateway.
• The number of calls being actively transcoded is limited to 5% of the total number of active calls.

Azure Communications Gateway also has limits on the SIP signaling.

Some endpoints might add parameters in the following headers to an in-dialog message when those parameters weren't present in the dialog-creating message. In that case, Azure Communications Gateway strips the parameters, because RFC 3261 doesn't permit this behavior.

• Request URI
• To header
• From header

The Provisioning API has a rate limit of 100 requests per minute, applied across all the resources. A batch request to update multiple resources counts as one request.

Azure Container Apps limits

For Azure Container Apps limits, see Quotas in Azure Container Apps.

The amount of disk space available to your application varies based on the associated workload profile. Available disk space determines the image size limit you can deploy to your container apps.

For dedicated workload profiles, the image size limit is per instance.

* The image size limit for a consumption workload profile is a shared among both image and app. For example, logs used by your app are subject to this size limit.

Azure Cosmos DB limits

For Azure Cosmos DB limits, see Limits in Azure Cosmos DB.

Azure Data Explorer limits

The following table describes the maximum limits for Azure Data Explorer clusters.

The following table describes the limits on management operations performed on Azure Data Explorer clusters.

Azure Database for MySQL

For Azure Database for MySQL limits, see Limitations in Azure Database for MySQL.

Azure Database for PostgreSQL

For Azure Database for PostgreSQL limits, see Limitations in Azure Database for PostgreSQL.

Azure Deployment Environments limits

Azure Files and Azure File Sync

To learn more about the limits for Azure Files and File Sync, see Azure Files scalability and performance targets.

Azure Functions limits

Notes on service limits:

1. By default, the timeout for the Functions 1.x runtime in an App Service plan is unbounded.
2. Requires the App Service plan be set to Always On. Pay at standard rates.
3. These limits are set in the host.
4. The actual number of function apps that you can host depends on the activity of the apps, the size of the machine instances, and the corresponding resource utilization.
5. The storage limit is the total content size in temporary storage across all apps in the same App Service plan. Consumption plan uses Azure Files for temporary storage.
6. When your function app is hosted in a Consumption plan, only the CNAME option is supported. For function apps in a Premium plan or an App Service plan, you can map a custom domain using either a CNAME or an A record.
7. Guaranteed for up to 60 minutes.
8. Workers are roles that host customer apps. Workers are available in three fixed sizes: One vCPU/3.5 GB RAM; Two vCPU/7 GB RAM; Four vCPU/14 GB RAM.
9. See App Service limits for details.
10. Including the production slot.
11. There's currently a limit of 5000 function apps in a given subscription.
12. The Flex Consumption plan is currently in preview.
13. Flex Consumption plan instance sizes are currently defined as either 2,048 MB or 4,096 MB. For more information, see Instance memory.
14. Flex Consumption plan during preview has a regional subscription quota that limits the total memory usage of all instances across a given region. For more information, see Instance memory.
15. In a Flex Consumption plan, the host doesn't enforce an execution time limit. However, there are currently no guarantees because the platform might need to terminate your instances during scale-in, deployments, or to apply updates.

For more information, see Functions Hosting plans comparison.

Azure Health Data Services

Azure Health Data Services limits

Health Data Services is a set of managed API services based on open standards and frameworks. Health Data Services enables workflows to improve healthcare and offers scalable and secure healthcare solutions. Health Data Services includes Fast Healthcare Interoperability Resources (FHIR) service, the Digital Imaging and Communications in Medicine (DICOM) service, and MedTech service.

FHIR service is an implementation of the FHIR specification within Health Data Services. It enables you to combine in a single workspace one or more FHIR service instances with optional DICOM and MedTech service instances. Azure API for FHIR is generally available as a stand-alone service offering.

Each FHIR service instance in Azure Health Data Services has a storage limit of 4 TB by default. If you have more data, you can ask Microsoft to increase storage up to 100 TB for your FHIR service. To request storage greater than 4 TB, create a support request on the Azure portal and use the issue type Service and Subscription limit (quotas).

Azure API for FHIR service limits

Azure API for FHIR is a managed, standards-based, compliant API for clinical health data that enables solutions for actionable analytics and machine learning.

Azure Kubernetes Service limits

¹ More are allowed upon request.
² Windows Server containers must use Azure CNI networking plug-in. Kubenet isn't supported for Windows Server containers.

Azure Lab Services

The following limits are for the number of Azure Lab Services resources.

Per resource type

Per region - Lab plans and labs

For more information about Azure Lab Services capacity limits, see Capacity limits in Azure Lab Services.

Contact support to request an increase your limit.

Azure Load Testing limits

For Azure Load Testing limits, see Service limits in Azure Load Testing.

Azure Machine Learning limits

The latest values for Azure Machine Learning Compute quotas can be found in the Azure Machine Learning quota page

Azure Maps limits

For Azure Maps queries per second limits, see Azure Maps QPS rate limits

The following table shows the cumulative data size limit for Azure Maps accounts in an Azure subscription. The Azure Maps Data service is available only at the Gen1 (S1) and Gen2 pricing tier.

Azure Managed Grafana limits

Azure Monitor limits

For Azure Monitor limits, see Azure Monitor service limits.

Azure Data Factory limits

Azure Data Factory is a multitenant service that has the following default limits in place to make sure customer subscriptions are protected from each other's workloads. To raise the limits up to the maximum for your subscription, contact support.

¹ The data integration unit (DIU) is used in a cloud-to-cloud copy operation. Learn more from Data integration units (version 2). For information on billing, see Azure Data Factory pricing.

² Azure Integration Runtime is globally available to ensure data compliance, efficiency, and reduced network egress costs.

If managed virtual network is enabled, the data integration unit (DIU) in all region groups are 2,400.

³ Pipeline, data set, and linked service objects represent a logical grouping of your workload. Limits for these objects don't relate to the amount of data you can move and process with Azure Data Factory. Data Factory is designed to scale to handle petabytes of data.

⁴ The payload for each activity run includes the activity configuration, the associated dataset(s) and linked service(s) configurations if any, and a small portion of system properties generated per activity type. Limit for this payload size doesn't relate to the amount of data you can move and process with Azure Data Factory. Learn about the symptoms and recommendation if you hit this limit.

Web service call limits

Azure Resource Manager has limits for API calls. You can make API calls at a rate within the Azure Resource Manager API limits.

Azure NetApp Files

Azure NetApp Files has a regional limit for capacity. The standard capacity limit for each subscription is 25 TiB, per region, across all service levels. To increase the capacity, use the Service and subscription limits (quotas) support request.

To learn more about the limits for Azure NetApp Files, see Resource limits for Azure NetApp Files.

Azure Policy limits

There's a maximum count for each object type for Azure Policy. For definitions, an entry of Scope means the management group or subscription. For assignments and exemptions, an entry of Scope means the management group, subscription, resource group, or individual resource.

Policy rules have more limits to the number of conditions and their complexity. For more information, go to Policy rule limits for more details.

Azure Quantum limits

Provider Limits & Quota

The Azure Quantum Service supports both first and third-party service providers.Third-party providers own their limits and quotas. Users can view offers and limits in the Azure portal when configuring third-party providers.

You can find the published quota limits for Microsoft's first party Optimization Solutions provider below.

Learn & Develop SKU

While on the Learn & Develop SKU, you cannot request an increase on your quota limits. Instead you should switch to the Performance at Scale SKU.

Performance at Scale SKU

Reach out to Azure Support to request a limit increase.

For more information, please review the Azure Quantum pricing page.Review the relevant provider pricing pages in the Azure portal for details on third-party offerings.

¹ Describes the number of jobs that can be queued at the same time.

Azure RBAC limits

The following limits apply to Azure role-based access control (Azure RBAC).

Azure SignalR Service limits

To request an update to your subscription's default limits, open a support ticket.

For more information about how connections and messages are counted, see Messages and connections in Azure SignalR Service.

If your requirements exceed the limits, switch from Free tier to Standard tier and add units. For more information, see How to scale an Azure SignalR Service instance?.

If your requirements exceed the limits of a single instance, add instances. For more information, see How to enable Geo-Replication in Azure SignalR Service.

Azure Spring Apps limits

To learn more about the limits for Azure Spring Apps, see Quotas and service plans for Azure Spring Apps.

Azure Storage limits

This section lists the following limits for Azure Storage:

• Standard storage account limits
• Azure Storage resource provider limits
• Azure Blob Storage limits
• Azure Queue storage limits
• Azure Table storage limits

Standard storage account limits

The following table describes default limits for Azure general-purpose v2 (GPv2), general-purpose v1 (GPv1), and Blob storage accounts. The ingress limit refers to all data that is sent to a storage account. The egress limit refers to all data that is received from a storage account.

Microsoft recommends that you use a GPv2 storage account for most scenarios. You can easily upgrade a GPv1 or a Blob storage account to a GPv2 account with no downtime and without the need to copy data. For more information, see Upgrade to a GPv2 storage account.

¹ With a quota increase, you can create up to 500 storage accounts with standard endpoints per region. For more information, see Increase Azure Storage account quotas.² Azure Storage standard accounts support higher capacity limits and higher limits for ingress and egress by request. To request an increase in account limits, contact Azure Support.

Azure Storage resource provider limits

The following limits apply only when you perform management operations by using Azure Resource Manager with Azure Storage. The limits apply per region of the resource in the request.

Azure Blob Storage limits

¹ Throughput for a single blob depends on several factors. These factors include but aren't limited to: concurrency, request size, performance tier, speed of source for uploads, and destination for downloads. To take advantage of the performance enhancements of high-throughput block blobs, upload larger blobs or blocks. Specifically, call the Put Blob or Put Block operation with a blob or block size that is greater than 256 KiB.

² Page blobs aren't yet supported in accounts that have a hierarchical namespace enabled.

The following table describes the maximum block and blob sizes permitted by service version.

Azure Queue storage limits

Azure Table storage limits

The following table describes capacity, scalability, and performance targets for Table storage.

Azure subscription creation limits

To learn more about the creation limits for Azure subscriptions, see Billing accounts and scopes in the Azure portal.

Azure Virtual Desktop Service limits

The following table describes the maximum limits for Azure Virtual Desktop.

¹If you require over 500 Application groups then please raise a support ticket via the Azure portal.

All other Azure resources used in Azure Virtual Desktop such as Virtual Machines, Storage, Networking etc. are all subject to their own resource limitations documented in the relevant sections of this article.To visualise the relationship between all the Azure Virtual Desktop objects, review this article Relationships between Azure Virtual Desktop logical components.

To get started with Azure Virtual Desktop, use the getting started guide.For deeper architectural content for Azure Virtual Desktop, use the Azure Virtual Desktop section of the Cloud Adoption Framework.For pricing information for Azure Virtual Desktop, add "Azure Virtual Desktop" within the Compute section of the Azure Pricing Calculator.

Azure VMware Solution limits

The following table describes the maximum limits for Azure VMware Solution.

* For information about Recovery Point Objective (RPO) lower than 15 minutes, see How the 5 Minute Recovery Point Objective Works in the vSphere Replication Administration guide.

For other VMware-specific limits, use the VMware configuration maximum tool.

Azure Web PubSub limits

To request an update to your subscription's default limits, open a support ticket.

For more information about how connections and messages are counted in billing, see Billing model in Azure Web PubSub Service.

If your requirements exceed the limits, scale up from Free tier to Standard/Premium tier or scale out units. For more information, see How to scale an Azure Web PubSub Service instance.

If your requirements exceed the limits of a single instance, add instances. For more information, see How to use Geo-Replication in Azure Web PubSub.

Backup limits

For a summary of Azure Backup support settings and limitations, see Azure Backup Support Matrices.

Batch limits

¹ For capacity management purposes, the default quotas for new Batch accounts in some regions and for some subscriptiontypes have been reduced from the above range of values. In some cases, these limits have been reduced to zero. When you create anew Batch account, check your quotas andrequest an appropriate core or service quota increase, if necessary.Alternatively, consider reusing Batch accounts that already have sufficient quota or user subscription pool allocationBatch accounts to maintain core and VM family quota across all Batch accounts on the subscription. Service quotas likeactive jobs or pools apply to each distinct Batch account even for user subscription pool allocation Batch accounts.

² To request an increase beyond this limit, contact Azure Support.

Classic deployment model limits

If you use classic deployment model instead of the Azure Resource Manager deployment model, the following limits apply.

¹Extra small instances count as one vCPU toward the vCPU limit despite using a partial CPU core.

²The storage account limit includes both Standard and Premium storage accounts.

Container Instances limits

¹To request a limit increase, create an Azure Support request. Free subscriptions including Azure Free Account and Azure for Students aren't eligible for limit or quota increases. If you have a free subscription, you can upgrade to a Pay-As-You-Go subscription.
²Default limit for Pay-As-You-Go subscription. Limit may differ for other category types.

Container Registry limits

The following table details the features and limits of the Basic, Standard, and Premium service tiers.

¹ Storage included in the daily rate for each tier. Additional storage may be used, up to the registry storage limit, at an additional daily rate per GiB. For rate information, see Azure Container Registry pricing. If you need storage beyond the registry storage limit, please contact Azure Support.

²ReadOps, WriteOps, and Bandwidth are minimum estimates. Azure Container Registry strives to improve performance as usage requires. Both resources, ACR, and the device must be in the same region to achieve a fast download speed.

³A docker pull translates to multiple read operations based on the number of layers in the image, plus the manifest retrieval.

⁴A docker push translates to multiple write operations, based on the number of layers that must be pushed. A docker push includes ReadOps to retrieve a manifest for an existing image.

⁵ Individual actions of content/delete, content/read, content/write, metadata/read, metadata/write corresponds to the limit of Repositories per scope map.

Content Delivery Network limits

*These two limits are only applicable to Azure CDN Standard from Microsoft (classic). If the traffic is not globally distributed and concentrated in one or two regions, or if a higher quota limit is needed, create an Azure Support request.

A Content Delivery Network subscription can contain one or more Content Delivery Network profiles. A Content Delivery Network profile can contain one or more Content Delivery Network endpoints. You might want to use multiple profiles to organize your Content Delivery Network endpoints by internet domain, web application, or some other criteria.

Data Lake Analytics limits

Azure Data Lake Analytics makes the complex task of managing distributed infrastructure and complex code easy. It dynamically provisions resources, and you can use it to do analytics on exabytes of data. When the job completes, it winds down resources automatically. You pay only for the processing power that was used. As you increase or decrease the size of data stored or the amount of compute used, you don't have to rewrite code. To raise the default limits for your subscription, contact support.

Data Factory limits

Azure Data Factory is a multitenant service that has the following default limits in place to make sure customer subscriptions are protected from each other's workloads. To raise the limits up to the maximum for your subscription, contact support.

¹ The data integration unit (DIU) is used in a cloud-to-cloud copy operation. Learn more from Data integration units (version 2). For information on billing, see Azure Data Factory pricing.

² Azure Integration Runtime is globally available to ensure data compliance, efficiency, and reduced network egress costs.

If managed virtual network is enabled, the data integration unit (DIU) in all region groups are 2,400.

³ Pipeline, data set, and linked service objects represent a logical grouping of your workload. Limits for these objects don't relate to the amount of data you can move and process with Azure Data Factory. Data Factory is designed to scale to handle petabytes of data.

⁴ The payload for each activity run includes the activity configuration, the associated dataset(s) and linked service(s) configurations if any, and a small portion of system properties generated per activity type. Limit for this payload size doesn't relate to the amount of data you can move and process with Azure Data Factory. Learn about the symptoms and recommendation if you hit this limit.

Web service call limits

Azure Resource Manager has limits for API calls. You can make API calls at a rate within the Azure Resource Manager API limits.

Data Lake Storage limits

Azure Data Lake Storage Gen2 is not a dedicated service or storage account type. It is the latest release of capabilities that are dedicated to big data analytics. These capabilities are available in a general-purpose v2 or BlockBlobStorage storage account, and you can obtain them by enabling the Hierarchical namespace feature of the account. For scale targets, see these articles.

• Scale targets for Blob storage.
• Scale targets for standard storage accounts.

Azure Data Lake Storage Gen1 is a dedicated service. It's an enterprise-wide hyper-scale repository for big data analytic workloads. You can use Data Lake Storage Gen1 to capture data of any size, type, and ingestion speed in one single place for operational and exploratory analytics. There's no limit to the amount of data you can store in a Data Lake Storage Gen1 account.

Azure Data Share enables organizations to simply and securely share data with their customers and partners.

Database Migration Service Limits

Azure Database Migration Service is a fully managed service designed to enable seamless migrations from multiple database sources to Azure data platforms with minimal downtime.

Device Update for IoT Hub limits

This table provides the limits for the Device Update for IoT Hub resource in Azure Resource Manager:

This table provides the various limits associated with the operations within Device Update for IoT Hub:

Digital Twins limits

Functional limits

The following table lists the functional limits of Azure Digital Twins.

Rate limits

The following table reflects the rate limits of different APIs.

Other limits

Limits on data types and fields within DTDL documents for Azure Digital Twins models can be found within its spec documentation in GitHub: Digital Twins Definition Language (DTDL) - version 2.

Query latency details are described in Query language. Limitations of particular query language features can be found in the query reference documentation.

Event Grid limits

Event Grid throttle limits

Event Grid offers a standard tier and basic tier. Event Grid standard tier enables pub-sub using Message Queuing Telemetry Transport (MQTT) broker functionality and pull-delivery of messages through the Event Grid namespace. Event Grid basic tier enables push delivery using Event Grid custom topics, Event Grid system topics, Event domains, and Event Grid partner topics. See Choose the right Event Grid tier. This article describes the quota and limits for both tiers.

Event Grid Namespace resource limits

Azure Event Grid namespaces is available in public preview and enables MQTT messaging, and HTTP pull delivery.The following limits apply to namespace resources in Azure Event Grid.

MQTT limits in Event Grid namespace

The following limits apply to MQTT in Azure Event Grid namespace resource.

* For MQTTv5, learn more about flow control support.

Events limits in Event Grid namespace

The following limits apply to events in Azure Event Grid namespace resource.

Custom topic, system topic, and partner topic resource limits

The following limits apply to Azure Event Grid custom topic, system topic, and partner topic resources.

Domain resource limits

The following limits apply to Azure Event Grid domain resource.

Event Hubs limits

The following tables provide quotas and limits specific to Azure Event Hubs. For information about Event Hubs pricing, see Event Hubs pricing.

Common limits for all tiers

The following limits are common across all tiers.

Basic vs. standard vs. premium vs. dedicated tiers

The following table shows limits that are different for basic, standard, premium, and dedicated tiers.

* Depends on various factors such as resource allocation, number of partitions, storage, and so on.

IoT Central limits

IoT Central limits the number of applications you can deploy in a subscription to 100. If you need to increase this limit, contact Microsoft support. To learn more, see Azure IoT Central quota and limits.

IoT Hub limits

The following table lists the limits associated with the different service tiers S1, S2, S3, and F1. For information about the cost of each unit in each tier, see Azure IoT Hub pricing.

The following table lists the limits that apply to IoT Hub resources.

IoT Hub throttles requests when the following quotas are exceeded.

IoT Hub Device Provisioning Service limits

The following table lists the limits that apply to Azure IoT Hub Device Provisioning Service resources.

The Device Provisioning Service has the following rate limits.

Key Vault limits

Azure Key Vault service supports two resource types: Vaults and Managed HSMs. The following two sections describe the service limits for each of them respectively.

Resource type: vault

This section describes service limits for resource type vaults.

Key transactions (maximum transactions allowed in 10 seconds, per vault per region¹):

Secrets, managed storage account keys, and vault transactions:

For information on how to handle throttling when these limits are exceeded, see Azure Key Vault throttling guidance.

¹ A subscription-wide limit for all transaction types is five times per key vault limit.

Backup keys, secrets, certificates

When you back up a key vault object, such as a secret, key, or certificate, the backup operation will download the object as an encrypted blob. This blob cannot be decrypted outside of Azure. To get usable data from this blob, you must restore the blob into a key vault within the same Azure subscription and Azure geography

Limits on count of keys, secrets and certificates:

Key Vault does not restrict the number of keys, secrets or certificates that can be stored in a vault. The transaction limits on the vault should be taken into account to ensure that operations are not throttled.

Key Vault does not restrict the number of versions on a secret, key or certificate, but storing a large number of versions (500+) can impact the performance of backup operations. See Azure Key Vault Backup.

Resource type: Managed HSM

This section describes service limits for resource type managed HSM.

Object limits

Transaction limits for administrative operations (number of operations per second per HSM instance)

Transaction limits for cryptographic operations (number of operations per second per HSM instance)

• Each Managed HSM instance constitutes three load balanced HSM partitions. The throughput limits are a function of underlying hardware capacity allocated for each partition. The tables below show maximum throughput with at least one partition available. Actual throughput may be up to 3x higher if all three partitions are available.
• Throughput limits noted assume that one single key is being used to achieve maximum throughput. For example, if a single RSA-2048 key is used the maximum throughput will be 1100 sign operations. If you use 1100 different keys with one transaction per second each, they will not be able to achieve the same throughput.

RSA key operations (number of operations per second per HSM instance)

EC key operations (number of operations per second per HSM instance)

This table describes number of operations per second for each curve type.

AES key operations (number of operations per second per HSM instance)

• Encrypt and Decrypt operations assume a 4KB packet size.
• Throughput limits for Encrypt/Decrypt apply to AES-CBC and AES-GCM algorithms.
• Throughput limits for Wrap/Unwrap apply to AES-KW algorithm.

Managed identity limits

• Each managed identity counts towards the object quota limit in a Microsoft Entra tenant as described in Microsoft Entra service limits and restrictions.

• The rate at which managed identities can be created have the following limits:

  1. Per Microsoft Entra tenant per Azure region: 400 create operations per 20 seconds.
  2. Per Azure Subscription per Azure region : 80 create operations per 20 seconds.

• The rate at which a user-assigned managed identity can be assigned with an Azure resource :

  1. Per Microsoft Entra tenant per Azure region: 400 assignment operations per 20 seconds.
  2. Per Azure Subscription per Azure region : 300 assignment operations per 20 seconds.

Account limits

Asset limits

Storage (media) limits

¹ The maximum size supported for a single blob is currently up to 5 TB in Azure Blob Storage. Additional limits apply in Media Services based on the VM sizes that are used by the service. The size limit applies to the files that you upload and also the files that get generated as a result of Media Services processing (encoding or analyzing). If your source file is larger than 260-GB, your Job will likely fail.

² The storage accounts must be from the same Azure subscription.

Jobs (encoding & analyzing) limits

³ This number includes queued, finished, active, and canceled Jobs. It does not include deleted Jobs.

Any Job record in your account older than 90 days will be automatically deleted, even if the total number of records is below the maximum quota.

Live streaming limits

⁴ For detailed information about Live Event limitations, see Live Event types comparison and limitations.

⁵ Live Outputs start on creation and stop when deleted.

Packaging & delivery limits

⁶ When using a custom Streaming Policy, you should design a limited set of such policies for your Media Service account, and re-use them for your StreamingLocators whenever the same encryption options and protocols are needed. You should not be creating a new Streaming Policy for each Streaming Locator.

⁷ Streaming Locators are not designed for managing per-user access control. To give different access rights to individual users, use Digital Rights Management (DRM) solutions.

Protection limits

Support ticket

For resources that are not fixed, you may ask for the quotas to be raised, by opening a support ticket. Include detailed information in the request on the desired quota changes, use-case scenarios, and regions required.
Do not create additional Azure Media Services accounts in an attempt to obtain higher limits.

Media Services v2 (legacy)

For limits specific to Media Services v2 (legacy), see Media Services v2 (legacy)

Mobile Services limits

For more information on limits and pricing, see Azure Mobile Services pricing.

Multifactor authentication limits

Networking limits

Networking limits - Azure Resource Manager

The following limits apply only for networking resources managed through Azure Resource Manager per region per subscription. Learn how to view your current resource usage against your subscription limits.

Public IP address limits

¹Default limits for Public IP addresses vary by offer category type, such as Free Trial, Pay-As-You-Go, CSP. For example, the default for Enterprise Agreement subscriptions is 1000.

²Public IP addresses limit refers to the total amount of Public IP addresses, including Basic and Standard.

Load balancer limits

The following limits apply only for networking resources managed through Azure Resource Manager per region per subscription. Learn how to view your current resource usage against your subscription limits.

Standard Load Balancer

¹ Backend IP configurations are aggregated across all load balancer rules including load balancing, inbound NAT, and outbound rules. Each rule a backend pool instance is configured to counts as one configuration.

Load Balancer doesn't apply any throughput limits. However, throughput limits for virtual machines and virtual networks still apply. For more information, see Virtual machine network bandwidth.

Gateway Load Balancer

All limits for Standard Load Balancer also apply to Gateway Load Balancer.

Basic Load Balancer

³ The limit for a single discrete resource in a backend pool (standalone virtual machine, availability set, or virtual machine scale-set placement group) is to have up to 250 Frontend IP configurations across a single Basic Public Load Balancer and Basic Internal Load Balancer.

The following limits apply only for networking resources managed through the classic deployment model per subscription. Learn how to view your current resource usage against your subscription limits.

Application Gateway limits

The following table applies to v1, v2, Standard, and WAF SKUs unless otherwise stated.

¹ The number of resources listed in the table applies to standard Application Gateway SKUs and WAF-enabled SKUs running CRS 3.2 or higher. For WAF-enabled SKUs running CRS 3.1 or lower, the supported number is 40. For more information, see WAF engine.

² Limit is per Application Gateway instance not per Application Gateway resource.

³ Must define the value via WAF Policy for Application Gateway.

Application Gateway for Containers limits

Kubernetes Ingress and Gateway API configuration limits

Azure Bastion limits

An instance is an optimized Azure VM that is created when you configure Azure Bastion. When you configure Azure Bastion using the Basic SKU, 2 instances are created. If you use the Standard SKU, you can specify the number of instances between 2-50.

*These workload types are defined here: Remote Desktop workloads
**These limits are based on RDP performance tests for Azure Bastion. The numbers may vary due to other on-going RDP sessions or other on-going SSH sessions.

Azure DNS limits

Public DNS zones

¹If you need to increase these limits, contact Azure Support.

Private DNS zones

Azure-provided DNS resolver

¹These limits are applied to every individual virtual machine and not at the virtual network level. DNS queries exceeding these limits are dropped.

DNS private resolver¹

¹Different limits might be enforced by the Azure portal until the portal is updated. Use PowerShell to provision elements up to the most current limits.

Azure Firewall limits

Azure Front Door (classic) limits

• In addition to the following limits, there are composite limit on the number of routing rules, front-end domains, protocols, and paths.

¹If the traffic isn't globally distributed and concentrated in one or more regions, or if a higher quota limited is need, create an Azure support request.

²To request a limit increase, create an Azure Support request. Free subscriptions including Azure Free Account and Azure for Students aren't eligible for limit or quota increases. If you have a free subscription, you can upgrade to a Pay-As-You-Go subscription.

Azure Front Door Standard and Premium service limits

• Maximum of 500 total Standard and Premium profiles per subscription.
• In addition to the following limits, there are composite limit on the number of routes, domains, protocols, and paths.

¹If the traffic isn't globally distributed and concentrated in one or more regions, or if a higher quota limited is need, create an Azure support request.

Timeout values

From Client to Front Door

• Front Door has an idle TCP connection timeout of 61 seconds.

Front Door to application back-end

• After the HTTP request gets forwarded to the back end, Azure Front Door waits for 60 seconds (Standard and Premium) or 30 seconds (classic) for the first packet from the back end. Then it returns a 503 error to the client, or 504 for a cached request. You can configure this value using the originResponseTimeoutSeconds field in Azure Front Door Standard and Premium API, or the sendRecvTimeoutSeconds field in the Azure Front Door (classic) API.

• After the back end receives the first packet, if the origin pauses for any reason in the middle of the response body beyond the originResponseTimeoutSeconds or sendRecvTimeoutSeconds, the response will be canceled.

• Front Door takes advantage of HTTP keep-alive to keep connections open for reuse from previous requests. These connections have an idle timeout of 90 seconds. Azure Front Door would disconnect idle connections after reaching the 90-second idle timeout. This timeout value can't be configured.

Upload and download data limit

Other limits

• Maximum URL size - 8,192 bytes - Specifies maximum length of the raw URL (scheme + hostname + port + path + query string of the URL)
• Maximum Query String size - 4,096 bytes - Specifies the maximum length of the query string, in bytes.
• Maximum HTTP response header size from health probe URL - 4,096 bytes - Specified the maximum length of all the response headers of health probes.
• Maximum rules engine action header value character: 640 characters.
• Maximum rules engine condition header value character: 256 characters.
• Maximum ETag header size: 128 bytes
• Maximum endpoint name for Standard and Premium: 46 characters.

For more information about limits that apply to Rules Engine configurations, see rules engine terminology

Azure Network Watcher limits

Azure Route Server limits

¹ If your NVA advertises more routes than the limit, the BGP session gets dropped.

² The number of VMs that Azure Route Server can support isn’t a hard limit and it depends on the availability and performance of the underlying infrastructure.

ExpressRoute limits

Route advertisem*nt limits

Virtual networks links allowed for each ExpressRoute circuit limit

*100-Gbps ExpressRoute Direct Only

ExpressRoute gateway performance limits

The following tables provides an overview of the different types of gateways, their respective limitations, and their expected performance metrics. These numbers are derived from the following testing conditions and represent the max support limits. Actual performance may vary, depending on how closely traffic replicates these testing conditions.

Testing conditions

Performance results

This table applies to both the Azure Resource Manager and classic deployment models.

^{1 The values in the table are estimates and varies depending on the CPU utilization of the gateway. If the CPU utilization is high and the number of supported VMs gets exceeded, the gateway will start to dropping packets.}

NAT Gateway limits

The following limits apply to NAT gateway resources managed through Azure Resource Manager per region per subscription. Learn how to view your current resource usage against your subscription limits.

¹ The total data throughput of 50 Gbps is split between outbound and inbound (return) data through a NAT gateway resource. Data throughput is rate limited at 25 Gbps for outbound data and 25 Gbps for inbound (response) data through NAT gateway.

² Default limits for NAT gateways vary by offer category type, such as Free Trial, pay-as-you-go, and CSP. For example, the default for Enterprise Agreement subscriptions is 1000.

Private Link limits

The following limits apply to Azure private link:

Traffic Manager limits

¹If you need to increase these limits, contact Azure Support.

VPN Gateway limits

The following limits apply to VPN Gateway resources and VPN Gateway virtual network gateways, unless otherwise stated.

Limits by gateway SKU

For more information about gateway SKUs and limits, see About gateway SKUs.

Gateway performance limits

The table in this section lists the results of performance tests for VpnGw SKUs. A VPN tunnel connects to a VPN gateway instance. Each instance throughput is mentioned in the throughput table in the previous section and is available aggregated across all tunnels connecting to that instance. The table shows the observed bandwidth and packets per second throughput per tunnel for the different gateway SKUs. All testing was performed between gateways (endpoints) within Azure across different regions with 100 connections and under standard load conditions. We used publicly available iPerf and CTSTraffic tools to measure performances for site-to-site connections

• The best performance was obtained when we used the GCMAES256 algorithm for both IPsec Encryption and Integrity.
• Average performance was obtained when using AES256 for IPsec Encryption and SHA256 for Integrity.
• The lowest performance was obtained when we used DES3 for IPsec Encryption and SHA256 for Integrity.