Unable to update maximum agents in Managed DevOps Pool even though quota is available

Question

Our Managed DevOps Pool is working well and has a current capacity of 2 Standard D2ads v5 agents. We have increased both the Compute and Managed DevOps Pools quotas for Standard DADSv5 Family vCPUs. This is verified when we try to increase the maximum number of agents in the pool from 2 to 3 and it does not show any error in the UI:

However, when we click "Apply", we are presented with the following error message and the maximum number of agents does not update:

LinkedAuthorizationFailed: The client has permission to perform action 'Microsoft.Compute/galleries/images/versions/read' on scope '/subscriptions/GUID_A/resourceGroups/azuredevops/providers/Microsoft.DevOpsInfrastructure/pools/azure-devops-managed-devops-pool', however the current tenant 'GUID_B' is not authorized to access linked subscription '9914839f-d4b6-410a-816f-bb28fb0253c1'.

where GUID_A is the subscription in which the Managed DevOps Pool is configured, GUID_B is our tenant and the final GUID ('9914839f-d4b6-410a-816f-bb28fb0253c1') is an unknown subscription within the MSAzureCloud.onmicrosoft.com tenant.

How do we fix this error and allow the maximum number of agents to be increased?

Our Azure DevOps account is configured with 1 free and 2 paid parallel jobs for self-hosted agents:

Answer 1

Hello @Peet Whittaker

The error indicates that this is not a quota or Azure DevOps parallel-jobs issue.

LinkedAuthorizationFailed

Microsoft.Compute/galleries/images/versions/read

Managed DevOps Pools runs its agent infrastructure in a Microsoft-managed Azure subscription, rather than directly in your own subscription. It also supports Azure Pipelines images, selected Marketplace images, and Azure Compute Gallery images.

Since your existing pool is already running successfully and increasing Maximum agents causes Azure to validate an image located in an unknown Microsoft-owned subscription, this appears to be an image authorization/reference problem during the pool update, rather than insufficient DADSv5 quota.

I would first check Settings → Pool → Images and identify which image type the pool currently uses.

If you're using an Azure Pipelines or selected Marketplace image, you shouldn't need access to that Microsoft-managed subscription yourself. In that case, the LinkedAuthorizationFailed referencing Microsoft's subscription should be raised with Microsoft as a potential Managed DevOps Pools backend/image authorization issue.

If you're using your own Azure Compute Gallery image, Microsoft requires the DevOpsInfrastructure service principal to have Reader access to the gallery/image. Verify that assignment before escalating.

You can also test the update through Azure CLI to determine whether this is portal-specific:

az mdp pool update \
  --pool-name <pool-name> \
  --resource-group <resource-group> \
  --maximum-concurrency 3

Microsoft documents maximumConcurrency/--maximum-concurrency as the supported way to modify Maximum agents.

Your 2 paid + 1 free self-hosted parallel jobs are sufficient for three concurrent Managed DevOps Pool jobs. Microsoft confirms that Managed DevOps Pools consume self-hosted parallel jobs, independently of the Maximum agents setting.

So I wouldn't request additional quota or purchase another parallel job at this point.

If the CLI update produces the same LinkedAuthorizationFailed referencing the unknown Microsoft subscription, open an Azure support case and provide the pool resource ID, correlation ID, UTC timestamp, and the Microsoft subscription ID shown in the error. That would be strong evidence that the failure is occurring during Microsoft's image authorization/validation rather than within your subscription.

Sharing these references with you:

Configure Managed DevOps Pool settings

Configure Managed DevOps Pool images

Troubleshoot Managed DevOps Pools

Please "Accept the Answer" if this information helped you. This will help us and others in the community.