VM Deployment

Question

Unable to create any VM resources

All deployment attempts fail with:

HTTP Error 400

Bad Request - Request Too Long

The size of the request headers is too long.

Occurs in:

• Azure Portal
• Azure Cloud Shell (CLI)

Tested with:

Ubuntu 24.04

Standard_D2s_v3

Region: East US 2

Also attempted in Central US.

Deployment fails before resource provisioning begins.

Suspected ARM request header / token size issue or tenant authentication problem.

Please investigate why ARM requests from this tenant are returning "Request Too Long".

Answer 1

Hello @Jeffrey Cummings ,

Has the issue been resolved? In addition to the comments above, I would like to share a few insights that may help:

The HTTP 400 “Request Too Long” error typically occurs due to oversized request headers generated by the browser session (such as cookies, cached tokens, or browser extensions).

In many cases, this is caused by an excessively large bearer token, which can result from the user account being assigned to a large number of roles, security groups, or additional claims.

To validate this, you can create a new Microsoft Entra ID account with minimal assignments specifically, the Global Administrator role in Entra ID and the Owner role on the Azure subscription. After creating the account, sign in using these credentials and attempt to create the VNet again to see if the issue persists.

Answer 2

Based on the error message “Bad Request: Request Too Long”, this behavior typically occurs when the authentication request is rejected before the deployment reaches the Azure Resource Manager (ARM) provisioning stage.

When a deployment request is sent to Azure Resource Manager, the request includes an authentication token in the HTTP header. In certain scenarios, this token can become excessively large due to factors such as:

Membership in a large number of Microsoft Entra ID groups

A high number of RBAC role assignments

Accumulated authentication cookies or additional claims

If the Authorization header exceeds the allowed size limit, Azure Resource Manager rejects the request and returns the HTTP 400 – Request Too Long error before any resource provisioning begins. This explains why the deployment fails immediately even though the VM configuration itself is valid.

To further validate and mitigate this behavior, we recommend the following steps:

1.Test deployment with a new user account

Create a new Microsoft Entra ID user with minimal group memberships and assign Owner or Contributor permissions to the subscription. If the deployment succeeds with this account, it would confirm that the issue is related to authentication token size.

2. Review and reduce group memberships

If the affected user belongs to a large number of Entra ID groups, removing unnecessary or redundant group memberships can help reduce the authentication token size.

3. Restrict group claims in the token

Work with your Entra ID administrator to configure the groups claim to emit only “Groups assigned to the application” instead of all groups. This limits the number of group claims included in the authentication token.

4. Consider using application roles instead of groups

Where possible, replace group-based access control with application roles, which produce smaller and more efficient claims in the authentication token.

5. Use a dedicated service principal for deployments

If deployments are being performed by a user account with extensive group memberships, consider creating a dedicated service principal with only the required RBAC permissions and minimal group associations.

Also, could you please try the deployment from InPrivate window.

These approaches can help reduce the authentication token size and prevent the “Request Too Long” error when sending requests to Azure Resource Manager.

Reference:

Azure Portal: Bad Request - Request Too Long

Hope this helps! Please let me know if you have any queries.