Microsoft Azure · Troubleshooting guide

Azure Troubleshooting: VMs Stuck Starting, NSG Blocks and Entra ID Sign-In Failures

Fix the classic Azure incidents: allocations that never complete, traffic dropped by hidden NSG rules, and conditional access lockouts.

Published August 28, 2026 · RCW IT Training

VMs and networking

VM stuck on 'Starting' or 'Creating' for many minutes

Often an allocation failure in the underlying cluster, or a quota limit. Stop (deallocate) the VM and start it again to land on fresh hardware, check subscription quota for the VM family and region, and read the Activity Log for the exact allocation error code.

RDP or SSH times out although the NSG 'allows' the port

Effective rules decide, not the blade you are looking at: NSGs attach to both NIC and subnet, and deny beats allow at the same priority. Open 'Effective security rules' on the NIC, enable NSG flow logs to watch the drop, and confirm the source CIDR matches your real egress IP. The OS firewall (Windows Firewall or ufw) is also a silent deny.

Identity and disks

Users blocked by sign-in risk or conditional access loops

Inspect Entra ID sign-in logs for the exact conditional access grant that failed - for example 'require compliant device' while Intune has not synced. Use a break-glass account excluded from CA for access, then fix the root cause: compliance state, named locations, or MFA registration.

Managed disk resized but the VM sees the old size

Premium disks resize online, but the guest must rescan and extend. On Linux, rescan the SCSI device (or restart) then growpart plus resize2fs or xfs_growfs; on Windows, rescan disks in Disk Management and Extend Volume. Disks only grow, never shrink - plan sizes before resizing.

Key takeaway: 'Effective security rules' and the Activity Log answer most Azure mysteries; a deallocate-start moves a stuck VM off bad hardware, and sign-in logs name the exact conditional access rule blocking users.