One convention, three verdicts
The same hyphenated prefix is legal for a key vault, illegal for a storage account, and illegal for a container registry
keyvault: kv-payments-prod storage: kv-payments-prod acr: kv-payments-prod
Azure Resource Name Validator
Check Azure resource names against the rules of their own resource provider, which disagree with each other: the length, the character set, and which types are globally unique because they become DNS labels.
Paste below, or drop a file anywhere on this panel
Or drop a file anywhere on this panel. Nothing is uploaded: the analysis runs in this tab.
The answer appears here
Paste on the left and press Check the names. Nothing leaves this tab.
Formatted
Results
Nothing else to flag.
No formatting problems, and nothing the rules object to. Worth remembering what that covers: this reads the file you pasted, not the account or cluster it will be applied to.
No finding matches that filter.
Wanted a different tool?
- Azure Resource ID Parser to read a resource id you already have, which carries the subscription and resource group the name sits inside.
Examples
Real input you can load into the tool above. Each one shows a different thing going wrong, because that is what the tool is for.
A VM name that excludes Windows
24 characters is comfortable on Linux and four over the NetBIOS limit a Windows VM name inherits
vm: web-server-production-01
A name a template produced
A doubled hyphen and a trailing period both mean a variable was empty, and both are rejected
keyvault: kv--prod resourcegroup: rg-payments-prod.
Names that compete with every other tenant
Storage accounts and app services are DNS labels, so the name is unique across all of Azure rather than within your subscription
storage: paymentsprod webapp: payments-api
Common mistakes
These are the ones that fail silently. The config is accepted, nothing raises an error, and the consequence arrives later.
Applying one naming convention across every resource type
The rules are per resource provider and they contradict each other. A storage account takes lowercase letters and digits only, a container registry adds no hyphens either, a key vault requires a leading letter, and a resource group accepts unicode. A convention that satisfies one fails another, and the failure is at deployment.
Instead:Encode the per-type rules in whatever generates the names. The character set is the part that differs most, so derive it from the type rather than from the environment.
Treating a name conflict as a problem in your subscription
Storage accounts, key vaults, app services, SQL servers and container registries are DNS labels, so the name is unique across every Azure tenant. "Already in use" usually means somebody else has it, and nothing in your account explains that.
Instead:Add a deterministic suffix derived from the subscription or resource group id. A random one changes on redeploy and orphans the previous resource.
Writing a naming convention on a Linux deployment
A Windows VM name is limited to 15 characters because it becomes the NetBIOS computer name; a Linux one allows 64. Nothing asks which you are deploying until it fails, so the convention silently excludes every Windows machine.
Instead:Cap VM names at 15 if the convention has to cover both. The Azure resource name and the guest hostname can differ, but only if you set the hostname separately.
Redeploying a template after deleting a key vault
Soft delete is on by default and cannot be turned off. The name is reserved for the retention period, ninety days unless changed, and nobody can take it including you. The redeploy fails with a conflict on a vault that appears nowhere.
Instead:Purge it with az keyvault purge when purge protection is off, or avoid needing the same name on a redeploy.
Letting a template produce a name with a trailing separator
A resource group cannot end with a period, a VM cannot end with a hyphen or a period, and no DNS-backed type can start or end with a hyphen. Two consecutive hyphens in a key vault name is the same fault: it means a template joined an empty variable.
Instead:Trim the generated name, and treat a doubled separator as a signal that a variable is unset rather than as a cosmetic problem.
Azure has no naming rules, it has one set per resource provider
They contradict each other, and a convention that satisfies one type fails another. These are the disagreements that cost time, rather than the ones a style guide would mention.
A hyphen is required by one type and forbidden by another
A key vault takes letters, digits and hyphens. A storage account takes lowercase letters and digits and nothing else. A container registry takes letters and digits with no hyphens at all. So the same organisational prefix has to be written three ways, and the failure arrives at deployment rather than at review.
kv-prod-01 key vault fine
kv-prod-01 storage rejected
kvprod01 storage fine
kvprod01 registry fine
kv-prod-01 registry rejectedSome names are globally unique, because they are DNS labels
A storage account is NAME.blob.core.windows.net. So the name competes with every other tenant on the planet, and "already in use" has nothing to do with your subscription and no explanation you can find in your own account. Those are also the types with the tightest character rules, because a DNS label cannot hold an underscore or an uppercase letter.
NAME.blob.core.windows.net storage account
NAME.vault.azure.net key vault
NAME.azurewebsites.net app service
NAME.azurecr.io container registry
NAME.database.windows.net SQL serverA Windows VM stops at 15 characters and a Linux VM at 64
Same resource type, two answers. Fifteen is the NetBIOS computer name limit, inherited from 1987, and nothing asks which operating system you are deploying until it fails. A naming convention that fits comfortably on Linux quietly excludes every Windows machine from it, and the convention is usually written by someone deploying Linux.
A deleted key vault name stays reserved
Soft delete is on by default and cannot be turned off. The name is held for the retention period, ninety days unless you changed it, and nobody can take it, including the subscription that deleted it. So tearing an environment down and redeploying the same template fails with a conflict on a vault that appears nowhere in the portal. Purge protection makes that reservation absolute for the full period.
The rules that catch generated names
A resource group may not END with a period, though periods elsewhere are fine. A key vault may not contain two consecutive hyphens, which almost always means a template joined an empty variable. A VM may not end with a hyphen or a period. Every one of these is a rule a human would not hit and a string template will.
Where to put the uniqueness suffix
The usual advice is to add a random suffix, and a random suffix changes on every deployment, which orphans the previous resource and leaves you paying for both. Derive it instead from something stable: the subscription id, or the resource group id, hashed and truncated. Then the name is unique, and it is the same name next time.
What this cannot see
Availability. Answering that means calling Azure, and this page calls nothing, so a globally unique name that passes here may still be taken by somebody else. It also checks the resource name rather than anything derived from it: a VM name that is legal here can still produce an invalid guest hostname, and a storage account name that is legal can still collide with a policy your organisation applies through Azure Policy. Those rules are yours rather than the provider's, and this only knows the provider's.
Related azure tools
Azure VM Size Decoder No d means no temp disk Azure Resource ID Parser Type and name pairs, not a path Azure Storage Account Security Analyzer The key makes the rest advisory Azure Cosmos DB Throughput Calculator Divided evenly, not by demand Azure Blob Lifecycle Policy Analyzer The tier you leave early is billed anyway Azure NSG Rule Analyzer First match wins, lowest number first
All 9 azure tools