How to make sure that VM Size used does have a sufficient available quota for usage in the region for the subscription id used.

Hi Prem Jha,

Thank you for the update. I have updated the code below. Please see if this helps you.

USAGE:

# Baseline: standard security, any arch, ignore quota just to see availability
python getVMSize.py --subscription <SUB-ID> --location eastus --ignore-quota --verbose


# Arm64 sizes in zone 1, allow previous-gen (if you really need them)
python getVMSize.py --subscription <SUB-ID> --location centralus --zones 1 --arch arm64 --include-previous-gen

CODE:

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

"""
List VM sizes that you can actually deploy in a region for a subscription,
excluding things that will fail later:
 - Subscription/region restrictions (NotAvailableForSubscription)
 - Zone incompatibility
 - Wrong CPU architecture (x64/Arm64)
 - Hyper-V generation & Trusted Launch constraints
 - Confidential-only sizes (off by default)
 - Previous-gen series (off by default)
 - Family + regional vCPU quota (unless --ignore-quota)

Tested with azure-identity and azure-mgmt-compute; uses only long-lived APIs.
"""

import argparse
import re
import sys
from typing import Dict, List, Optional, Tuple

from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient
from azure.core.exceptions import HttpResponseError


# ---------------------------- helpers ----------------------------

def norm(s: str) -> str:
    return re.sub(r"[^a-z0-9]", "", (s or "").lower())

def cap(capabilities, name: str, default: Optional[str] = None) -> Optional[str]:
    """Return capability value by name (case-insensitive)."""
    for c in capabilities or []:
        if (c.name or "").lower() == name.lower():
            return c.value
    return default

def has_cap(capabilities, name: str, truthy: str = "true") -> bool:
    val = cap(capabilities, name)
    return (val or "").strip().lower() == truthy.lower()


def is_restricted_in_location(sku, location: str) -> bool:
    """True if SKU is marked NotAvailableForSubscription in the location."""
    for r in (sku.restrictions or []):
        if r.reason_code == "NotAvailableForSubscription":
            info = r.restriction_info
            if info and info.locations and location in info.locations:
                return True
    return False

def zones_supported(sku, location: str) -> List[str]:
    """Zones that are supported for the location."""
    for li in (sku.location_info or []):
        if li.location == location and li.zones:
            return list(li.zones)
    return list(sku.zones or [])  # may be empty (non-zonal or unspecified)

def zones_blocked(sku, location: str) -> List[str]:
    """Zones explicitly blocked for the location."""
    blocked = set()
    for r in (sku.restrictions or []):
        if r.reason_code == "NotAvailableForSubscription" and getattr(r, "type", None) == "Zone":
            info = r.restriction_info
            if info and info.locations and location in info.locations:
                blocked.update(info.zones or [])
    return list(blocked)


# A pragmatic list; keep toggleable via CLI.
PREVIOUS_GEN_FAMILIES = {
    # General purpose (older waves)
    "standard d-series", "dv1-series", "dsv1-series", "dv2-series", "dsv2-series", "ds-series", "b-series (v1)",
    # Compute optimized
    "f-series", "fs-series",
    # Memory optimized older
    "ev3-series", "esv3-series", "ev4-series", "esv4-series", "eav4-series", "easv4-series",
    "edv4-series", "edsv4-series", "g-series", "gs-series",
    # Storage optimized older
    "lsv1-series", "lsv2-series",
}
_PREV_NORM = {norm(x) for x in PREVIOUS_GEN_FAMILIES}

def is_previous_gen_family(family: str) -> bool:
    return norm(family) in _PREV_NORM


def supports_hyperv_gen(sku, required_gen: Optional[int]) -> bool:
    """Check Hyper-V generation support via capability HyperVGenerations."""
    if required_gen is None:
        return True
    hv = (cap(sku.capabilities, "HyperVGenerations", "") or "").lower()
    if required_gen == 1:
        return "v1" in hv
    if required_gen == 2:
        return "v2" in hv
    return False

def supports_trusted_launch(sku) -> bool:
    """Trusted Launch needs Gen2 and must not be explicitly disabled."""
    hv = (cap(sku.capabilities, "HyperVGenerations", "") or "").lower()
    if "v2" not in hv:
        return False
    # Some SKUs expose TrustedLaunchDisabled=True when TL is not available.
    tld = cap(sku.capabilities, "TrustedLaunchDisabled")
    return not (tld and str(tld).lower() == "true")

def is_confidential_only(sku) -> bool:
    """
    Heuristic: Confidential-only families tend to be DC*/EC* or advertise
    ConfidentialComputingType (e.g., TDX/SNP). We treat those as confidential.
    """
    fam = (sku.family or "").strip().upper()
    cct = cap(sku.capabilities, "ConfidentialComputingType")
    return fam.startswith("DC") or fam.startswith("EC") or bool(cct)

def arch_matches(sku, want_arch: str) -> bool:
    """
    Match CPU architecture. If want_arch is 'arm64', require explicit Arm64.
    If want_arch is 'x64', accept 'x64' or missing (older SKUs often omit).
    """
    if want_arch == "any":
        return True
    a = (cap(sku.capabilities, "CpuArchitectureType", "") or "").lower()
    if want_arch == "arm64":
        return a == "arm64"
    # x64
    return a in ("", "x64")


# ---------------------------- quotas ----------------------------

def get_usage_quota(compute: ComputeManagementClient, location: str
                    ) -> Tuple[Tuple[Optional[int], Optional[int]], Dict[str, Tuple[int, int, str]]]:
    """
    Returns:
      regional: (used, limit) for total regional vCPUs (if found; else (None, None))
      family_quota: dict key=normalized usage name ("standard<family>family") -> (used, limit, label)
    """
    usage = list(compute.usage.list(location))
    regional_used = regional_limit = None
    fam: Dict[str, Tuple[int, int, str]] = {}

    for u in usage:
        name_val = (getattr(u.name, "value", None) or "").lower()
        name_loc = (getattr(u.name, "localized_value", None) or "").lower()

        # Regional total cores/vCPUs (different tenants/locales label differently)
        if "total" in name_loc and ("vcpu" in name_loc or "core" in name_loc):
            regional_used, regional_limit = u.current_value, u.limit
        elif name_val == "cores" and ("total" in name_loc or "regional" in name_loc):
            regional_used, regional_limit = u.current_value, u.limit

        # Family rows (e.g., "Standard Dv5 Family vCPUs")
        if "family" in name_loc and ("vcpu" in name_loc or "core" in name_loc):
            k = norm(getattr(u.name, "value", "") or u.name.localized_value)
            fam[k] = (u.current_value, u.limit, u.name.localized_value or u.name.value)

    return (regional_used, regional_limit), fam

def find_family_row(fam_map: Dict[str, Tuple[int, int, str]], family: str):
    exact = f"standard{norm(family)}family"
    if exact in fam_map:
        return fam_map[exact]
    f_norm = norm(family)
    for k, v in fam_map.items():
        if f_norm in k:
            return v
    return None


# ---------------------------- main ----------------------------

def parse_args():
    ap = argparse.ArgumentParser("List truly deployable VM sizes for your subscription & region")
    ap.add_argument("--subscription", required=True, help="Subscription ID (GUID)")
    ap.add_argument("--location", required=True, help="Region, e.g., eastus, westus3")
    ap.add_argument("--instances", type=int, default=1, help="Intended VM count for headroom calc")

    # Optional filters
    ap.add_argument("--zones", nargs="*", default=None, help="Require these zones (e.g., 1 2)")
    ap.add_argument("--arch", choices=["x64", "arm64", "any"], default="any")
    ap.add_argument("--require-eah", action="store_true", help="Require Encryption at Host")
    ap.add_argument("--require-gen1", action="store_true", help="Require Hyper-V Gen1 compatibility")
    ap.add_argument("--security-type", choices=["standard", "trustedlaunch", "confidential"],
                    default="standard",
                    help="Enforce security posture. TL implies Gen2.")
    ap.add_argument("--families", nargs="*", default=None,
                    help="Optional family prefix allowlist (e.g., D E F B)")

    # Policy toggles
    ap.add_argument("--exclude-confidential-only", action="store_true", default=True,
                    help="Exclude confidential-only families (default: on)")
    ap.add_argument("--include-previous-gen", action="store_true", default=False,
                    help="Include previous-gen families (default: excluded)")
    ap.add_argument("--strict-family-quota", action="store_true",
                    help="Drop SKUs when no family quota row exists (default: rely on regional)")

    # Quota & diagnostics
    ap.add_argument("--ignore-quota", action="store_true", help="List sizes even if quota is insufficient")
    ap.add_argument("--verbose", action="store_true")
    return ap.parse_args()


def main():
    args = parse_args()

    # Sanity: TL + Gen1 are incompatible; prefer TL (Gen2) if both set.
    if args.security_type == "trustedlaunch" and args.require_gen1:
        print("[WARN] --security-type trustedlaunch implies Gen2; ignoring --require-gen1.", file=sys.stderr)
        args.require_gen1 = False

    # Auth + client
    cred = DefaultAzureCredential()
    compute = ComputeManagementClient(cred, args.subscription)

    # Counters for diagnostics
    reasons = {
        "restricted": 0, "zones": 0, "arch": 0, "eah": 0, "gen": 0, "tl": 0,
        "conf_only": 0, "prev_gen": 0, "no_cores": 0, "quota_family": 0, "quota_regional": 0,
        "family_missing": 0
    }
    examples = []  # collect a few rejection examples

    # ---- 1) Enumerate SKUs (client-side filter by location) ----
    try:
        all_skus = compute.resource_skus.list()
    except HttpResponseError as e:
        print(f"[ERROR] Failed to list resource SKUs: {e}", file=sys.stderr)
        sys.exit(1)

    candidates = []
    for sku in all_skus:
        if sku.resource_type != "virtualMachines":
            continue
        if args.location not in (sku.locations or []):
            continue
        if is_restricted_in_location(sku, args.location):
            reasons["restricted"] += 1
            if len(examples) < 12: examples.append((sku.name, "restricted in region"))
            continue

        fam = sku.family or ""
        if args.families and not any(fam.upper().startswith(p.upper()) for p in args.families):
            continue

        # Zones
        if args.zones:
            supported = set(zones_supported(sku, args.location))
            blocked = set(zones_blocked(sku, args.location))
            need = set(args.zones)
            if not need.issubset(supported) or (need & blocked):
                reasons["zones"] += 1
                if len(examples) < 12: examples.append((sku.name, f"zones {sorted(list(need))} not supported"))
                continue

        # Architecture
        if not arch_matches(sku, args.arch):
            reasons["arch"] += 1
            if len(examples) < 12: examples.append((sku.name, f"arch mismatch (want {args.arch})"))
            continue

        # Encryption at Host
        if args.require_eah and not has_cap(sku.capabilities, "EncryptionAtHostSupported"):
            reasons["eah"] += 1
            if len(examples) < 12: examples.append((sku.name, "EaH not supported"))
            continue

        # Security posture
        if args.security_type == "trustedlaunch":
            if not supports_trusted_launch(sku):
                reasons["tl"] += 1
                if len(examples) < 12: examples.append((sku.name, "not Trusted Launch capable"))
                continue
            # TL implies Gen2
            if not supports_hyperv_gen(sku, 2):
                reasons["gen"] += 1
                if len(examples) < 12: examples.append((sku.name, "not Gen2"))
                continue
        elif args.security_type == "confidential":
            if not is_confidential_only(sku):
                reasons["conf_only"] += 1
                if len(examples) < 12: examples.append((sku.name, "not confidential-only"))
                continue
        else:
            # standard posture: optionally exclude confidential-only
            if args.exclude_confidential_only and is_confidential_only(sku):
                reasons["conf_only"] += 1
                if len(examples) < 12: examples.append((sku.name, "confidential-only excluded"))
                continue
            # Optional explicit Gen1 requirement
            if args.require_gen1 and not supports_hyperv_gen(sku, 1):
                reasons["gen"] += 1
                if len(examples) < 12: examples.append((sku.name, "Gen1 not supported"))
                continue

        # Previous-gen filter (toggleable)
        if not args.include_previous_gen and is_previous_gen_family(fam):
            reasons["prev_gen"] += 1
            if len(examples) < 12: examples.append((sku.name, "previous-gen family"))
            continue

        candidates.append(sku)

    if not candidates:
        print("No SKUs left after capability/availability filtering in region.")
        if args.verbose:
            print("[DEBUG] reasons:", reasons)
            if examples:
                print("[DEBUG] samples:", examples)
        sys.exit(2)

    # ---- 2) vCPU per size ----
    try:
        sizes = {s.name: s.number_of_cores for s in compute.virtual_machine_sizes.list(args.location)}
    except HttpResponseError as e:
        print(f"[ERROR] Failed to list VM sizes in {args.location}: {e}", file=sys.stderr)
        sys.exit(1)

    with_cores = []
    for sku in candidates:
        vcpus = sizes.get(sku.name)
        if not vcpus:
            reasons["no_cores"] += 1
            continue
        with_cores.append((sku, vcpus))

    if not with_cores:
        print("No candidate sizes have vCPU info from size API; cannot evaluate quota.")
        if args.verbose:
            print("[DEBUG] reasons:", reasons)
        sys.exit(2)

    # ---- 3) Quota headroom ----
    regional, fam_map = get_usage_quota(compute, args.location)
    reg_used, reg_limit = regional

    usable = []
    for sku, vcpus in with_cores:
        need = vcpus * max(1, args.instances)

        fam_row = find_family_row(fam_map, sku.family or "")
        if fam_row is None:
            reasons["family_missing"] += 1
            if args.strict_family_quota:
                continue
        else:
            fu, fl, _lbl = fam_row
            if not args.ignore_quota and (fu is not None and fl is not None and (fu + need > fl)):
                reasons["quota_family"] += 1
                continue

        if not args.ignore_quota and reg_used is not None and reg_limit is not None:
            if reg_used + need > reg_limit:
                reasons["quota_regional"] += 1
                continue

        usable.append((sku.name, sku.family or "", vcpus))

    if not usable:
        print("No SKUs satisfy quota headroom in this region.")
        if args.verbose:
            print("[DEBUG] reasons:", reasons)
            if reg_used is not None and reg_limit is not None:
                print(f"[DEBUG] Regional vCPUs: used {reg_used} / limit {reg_limit}")
        sys.exit(3)

    # ---- 4) Output ----
    usable.sort(key=lambda x: (x[1], x[2], x[0]))
    print(f"Deployable VM sizes in {args.location} (instances={args.instances}):")
    print(f"{'Name':28} {'Family':22} {'vCPUs':>5}")
    print("-" * 60)
    for name, fam, v in usable:
        print(f"{name:28} {fam:22} {v:>5}")

    if args.verbose:
        print("\n[DEBUG] filtered-out reasons:", reasons)
        if reg_used is not None and reg_limit is not None:
            print(f"[DEBUG] Regional vCPUs: used {reg_used} / limit {reg_limit}")
        # Show a few quota rows for sanity
        shown = 0
        for _, (_, lim, lbl) in fam_map.items():
            if shown >= 6:
                break
            print(f"[DEBUG] Family quota row: {lbl} (limit={lim})")
            shown += 1


if __name__ == "__main__":
    main()

Please upvote and accept the thread as answer if it helps!!