Info icon
End of Life Notice: For Trend Cloud One™ - Conformity Customers, Conformity will reach its End of Sale on “July 31st, 2025” and End of Life “July 31st, 2026”. The same capabilities and much more is available in Trend Vision One™ Cloud Risk Management. For details, please refer to Upgrade to Trend Vision One
Logo of Trend Micro
Use the Knowledge Base AI to help improve your Cloud Posture

Enable Dynamic Quota

Trend Vision One™ provides continuous assurance that gives peace of mind for your cloud infrastructure, delivering over 1100 automated best practice checks.

Risk Level: Medium (should be achieved)
Rule ID: AIServices-012

Ensure that Dynamic Quota is enabled for your Azure AI Services instances. Dynamic Quota (also known as Dynamic Throttling) is an AI Services feature that lets a deployment use more quota than its set Tokens Per Minute (TPM) limit if extra capacity is available. Dynamic Quota can be enabled at the instance level by setting the "dynamicThrottlingEnabled" property to true. When enabled, your deployment can handle higher traffic before receiving HTTP 429 (Too Many Requests) errors, allowing you to process more requests sooner.

This rule resolution is part of the Conformity Security & Compliance tool for Azure.

Reliability
Performance
efficiency

Dynamic Quota allows an Azure AI Services model deployment to opportunistically use more capacity than its assigned quota when available. Enabling Dynamic Quota (Dynamic Throttling) can help protect against resource exhaustion attacks by making your service more resilient to sudden spikes in traffic, including malicious ones. Dynamic Throttling doesn't act as a firewall, but it acts as a shock absorber for your service's capacity. It allows your application to remain available to legitimate users by opportunistically handling a burst of requests, whether they are from a legitimate, high-traffic event or a malicious attack.

Audit

To determine if Dynamic Quota (Dynamic Throttling) is enabled for Microsoft Azure AI Services instances, perform the following operations:

Checking Azure AI Services instances for Dynamic Throttling configuration settings using the Azure Console (Azure Portal) is not currently supported.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account: 

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs): 

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output): 

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run cognitiveservices account list command (Windows/macOS/Linux) with custom output filters to list the name and the associated resource group for each Azure AI Services instance available within the current subscription: 

az cognitiveservices account list
	--output table
	--query '[?(kind==`AIServices`)].{name:name, resourceGroup:resourceGroup}'

05 The command output should return the requested AI Services instance identifiers: 

Name                               ResourceGroup
-------------------------------    ------------------------------
cc-project5-ai-service-instance    cloud-shell-storage-westeurope
cc-project5-ai-foundry-instance    cloud-shell-storage-westeurope

06 Run cognitiveservices account show command (Windows/macOS/Linux) with the name of the Azure AI Services instance that you want to examine as the identifier parameter and custom output filters to determine if Dynamic Quota is enabled for the selected instance: 

az cognitiveservices account show
	--name cc-project5-ai-service-instance
	--resource-group cloud-shell-storage-westeurope
	--query '{dynamicThrottlingEnabled:properties.dynamicThrottlingEnabled}'

07 The command output should return the value of the "dynamicThrottlingEnabled" configuration property: 

{
	"dynamicThrottlingEnabled": false
}

If the cognitiveservices account show command output returns null or false for "dynamicThrottlingEnabled", as shown in the example above, the Dynamic Quota feature is not enabled for the selected Microsoft Azure AI Services instance.

Remediation / Resolution

To enable Dynamic Quota (Dynamic Throttling) for your Azure AI Services instances, perform the following operations:

Enabling Dynamic Throttling for Azure AI Services instances using the Azure Console (Azure Portal) is not currently supported.

Using Azure CLI

01 Run account list command (Windows/macOS/Linux) with custom output filters to list the IDs of the cloud subscriptions available in your Azure cloud account: 

az account list
	--query '[*].id'

02 The command output should return the requested subscription identifiers (IDs): 

[
	"abcdabcd-1234-abcd-1234-abcdabcdabcd",
	"abcd1234-abcd-1234-abcd-abcd1234abcd"
]

03 Run account set command (Windows/macOS/Linux) with the ID of the Azure cloud subscription that you want to examine as the identifier parameter to set the selected subscription to be the current active subscription (the command does not produce an output): 

az account set
	--subscription abcdabcd-1234-abcd-1234-abcdabcdabcd

04 Run cognitiveservices account list command (Windows/macOS/Linux) with custom output filters to list the resource identifier (ID) of each Azure AI Services instance available within the current subscription: 

az cognitiveservices account list
	--query '[?(kind==`AIServices`)].id'

05 The command output should return the requested AI Services instance identifiers: 

[
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance",
	"/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-foundry-instance"
]

06 Run az rest command (Windows/macOS/Linux) with the ID of the Azure AI Services instance that you want to configure as the identifier parameter, to enable Dynamic Quota (Dynamic Throttling) for the selected instance by setting the "dynamicThrottlingEnabled" property to true: 

az rest
	--method patch
	--url "https://management.azure.com/subscriptions/abcdabcd-1234-abcd-1234-abcdabcdabcd/resourceGroups/cloud-shell-storage-westeurope/providers/Microsoft.CognitiveServices/accounts/cc-project5-ai-service-instance/deployments/production?api-version=2023-10-01-preview"
	--body "{\"properties\": {\"dynamicThrottlingEnabled\": true}}"
	--query '{"dynamicThrottlingEnabled":properties.dynamicThrottlingEnabled}'

07 The command output should return the new value of the "dynamicThrottlingEnabled" property: 

{
	"dynamicThrottlingEnabled": true
}

References

Publication date Sep 10, 2025

Related AIServices rules