Feature: Storage quota coverage (storage-account count per region, managed-disk capacity)

[haflidif]

Alignment with toolkit principles

• This stays read-only by default — it does not mutate Azure resources, or (if a write is essential) it follows the opt-in, -WhatIf/ShouldProcess pattern of Deploy-QuotaGroups.ps1.
• It works with Reader access for analysis (writes, if any, document their elevated roles).
• It introduces no telemetry and no data leaving the user's machine.

Problem / motivation

docs/concepts.md lists storage account limits as intentionally out of scope for now. The
per-region storage-account cap (250 by default) and managed-disk capacity are real constraints that
bite at scale and belong in a complete capacity picture.

Proposed solution

Add a read-only Get-StorageQuota.ps1 mirroring the compute pattern:

• az storage account list count vs the per-region limit, plus
  Microsoft.Storage usages REST endpoint where available.
• Output CSV: sub, region, used, limit, available, pctUsed.
• Dashboard: a storage-headroom indicator per region.

Alternatives considered

• Defer indefinitely — acceptable, but it is a known gap the docs already flag.

References

• Storage limits — Azure subscription and service limits

Area

Quota / quota groups, Discovery (used SKUs / inventory)

[haflidif]

Design — #14 Storage quota coverage

Status: design draft for review (no code yet). API surface verified against Microsoft Learn (see References) and exercised live (az storage account show-usage --location norwayeast returns StorageAccounts currentValue/limit; storage RP locations/usages api-version 2026-04-01 confirmed valid).

1. Summary

Add read-only Get-StorageQuota.ps1 to report Azure Storage account regional quota usage across one or more subscriptions. Pure az/az rest; dot-sources Common.ps1; Reader-only; PS 5.1-safe; local CSV in output/.

Caveat: quota is NOT guaranteed capacity — this reports control-plane quota/headroom, not deployability.

Scope, stated honestly:

• Queryable quota: storage-account count per subscription + region (the regional Storage RP usage API), reporting Used / Limit / Available / PctUsed + flags.
• Managed disk capacity: there is no general per-subscription managed-disk capacity quota usage endpoint equivalent to compute vCPU usages. The design does not invent Used/Limit for disks. Optionally it includes an informational managed-disk inventory (total provisioned GiB by region/SKU) with no limit and no percent — clearly flagged as inventory, not quota.

2. Script signature

param(
    [string[]] $Location = @('norwayeast'),
    [string[]] $SubscriptionIds,
    [string]   $SubscriptionCsv,
    [string]   $OutPath,
    [switch]   $IncludeDiskCapacityInventory
)

• Dot-source Common.ps1, call Assert-AzLogin, resolve via Resolve-Subscriptions -SubscriptionIds/-SubscriptionCsv.
• -OutPath defaults to Get-DefaultOutDir; -Location defaults to norwayeast; accept -Location all to expand via az account list-locations.
• Iterate subscriptions with az account set --subscription <id>; export with Export-Csv -NoTypeInformation -Encoding UTF8.
• File: storage-quota-<region>-<yyyyMMdd>.csv (or storage-quota-all-<yyyyMMdd>.csv for all-regions).

3. Data collection

Storage-account count quota (verified live):

az storage account show-usage --location <region> --only-show-errors -o json

backed by:

GET https://management.azure.com/subscriptions/{sub}/providers/Microsoft.Storage/locations/{location}/usages?api-version=2026-04-01

Verified response (live):

{ "name": { "value": "StorageAccounts", "localizedValue": "Storage Accounts" }, "currentValue": 6, "limit": 250, "unit": "Count" }

Select the usage where name.value == 'StorageAccounts'; derive Used / Limit / Available / PctUsed. Use the regional endpoint (not the legacy subscription-wide Microsoft.Storage/usages).

Managed disk capacity inventory (only with -IncludeDiskCapacityInventory) — Resource Graph, summed diskSizeGB, treated as informational:

Resources
| where type =~ 'microsoft.compute/disks'
| where location =~ '<region>'
| extend diskSizeGB = tolong(properties.diskSizeGB), diskSku = tostring(sku.name)
| summarize Used = sum(diskSizeGB), DiskCount = count() by subscriptionId, location, diskSku

Disk rows carry Metric = ManagedDiskProvisionedGiB, empty Limit/Available/PctUsed, and a Note that no general managed-disk capacity quota API exists. (Disk SKU availability is Microsoft.Compute/skus metadata, not quota; per-disk size maxima are documented per-resource constants.)

4. Output schema — storage-quota-<region>-<yyyyMMdd>.csv

Subscription, SubscriptionId, Region, Metric (StorageAccounts | ManagedDiskProvisionedGiB), Used, Limit, Available, PctUsed, Unit (Count | GiB), IsQuota (True for account count, False for disk inventory), Flag (OK/NearLimit/AtLimit/Informational), Notes.

Example:

Subscription,SubscriptionId,Region,Metric,Used,Limit,Available,PctUsed,Unit,IsQuota,Flag,Notes
Contoso,00000000-...,norwayeast,StorageAccounts,201,250,49,80.4,Count,True,NearLimit,"Quota is not guaranteed capacity."
Contoso,00000000-...,norwayeast,ManagedDiskProvisionedGiB,18432,,,,GiB,False,Informational,"Inventory only; no managed-disk capacity quota endpoint."

5. Derived insights / flags

For StorageAccounts rows: AtLimit when Used >= Limit; NearLimit when PctUsed >= 80 and Used < Limit; OK below; Unknown if limit missing/zero. Default threshold 80%. Disk-inventory rows are never flagged Near/At (no comparable limit).

6. Dashboard integration (fast-follow)

A storage-headroom card sourced from storage-quota-*.csv, highlighting NearLimit/AtLimit regions; show disk provisioned-GiB separately as "informational" to avoid implying quota compliance.

7. Edge cases & caveats

• Storage-account quota is regional per subscription; Learn documents 250 default (500 by request).
• The legacy subscription-wide Microsoft.Storage/usages exists but is not regional — not used here.
• Managed disks expose no general per-subscription capacity quota usage endpoint; inventory sums provisioned diskSizeGB (not consumed/billable bytes).
• DNS-zone-endpoint storage accounts have a separate documented (preview) limit; v1 reports only what the RP usage API returns.
• Resource Graph may lag ARM slightly; Reader is sufficient.
• PS 5.1-safe syntax only.

8. Open questions

1. -IncludeDiskCapacityInventory default off (avoid mixing quota + inventory) or on (issue explicitly mentions disk capacity)?
2. -Location all: one CSV per region or one combined file?
3. NearLimit threshold fixed at 80% or configurable in v1?
4. Group disk inventory by region only, or also by disk SKU?
5. Future: separate handling for DNS-zone-endpoint storage-account limits if the API exposes the breakdown?

References

• Storage account scalability & regional limits
• Storage RP regional Usages – List By Location (REST, 2026-04-01)
• az storage account show-usage CLI reference
• Managed disk types & per-disk size limits
• Microsoft.Compute/disks schema (diskSizeGB)

[haflidif]

Shipped in #25 (squash-merged to main).

E2E validated under Windows PowerShell 5.1 against a live tenant: the StorageAccounts count quota returns correctly (e.g. 12/250, OK); the optional disk-inventory path against a subscription with managed disks returns provisioned-GiB rows grouped by disk SKU (Standard_LRS, Premium_LRS, StandardSSD_LRS, StandardSSD_ZRS), all correctly flagged IsQuota=False / Informational with a blank limit — inventory, not a quota signal. AST-clean and PS 5.1-safe. No tenant identifiers or resource names in the repo or output schema.