---
title: Troubleshoot Azure Tiered License Issues in Access Server
canonical: https://openvpn.net/as-docs/azure-license-troubleshooting/
product: Access Server Docs
description: Fix an Azure Tiered Access Server instance stuck in demonstration mode with two connections — verify the Instance Metadata Service (IMDS), then check network security groups and firewalls.
---

# Troubleshoot Azure Tiered License Issues in Access Server

Use this guide to troubleshoot licensing issues with an Azure Tiered deployment of OpenVPN Access Server, including when the server shows a different connection limit than the Connection tier you purchased through Microsoft Azure Marketplace.

Azure Tiered instances are pre-licensed through Azure Marketplace. You choose a fixed connection tier when you deploy the instance, and Azure handles the Access Server software subscription. You don't purchase or activate a separate OpenVPN license key.

This guide helps you verify the Azure Marketplace information available to Access Server, resolve connectivity issues that can prevent license validation, and collect Azure licensing debug information for further troubleshooting.

For deployment instructions, refer to the [Azure Tiered guide](https://openvpn.net/as-docs/v3/azure-tiered.md). For information about other Azure licensing models, refer to [Azure licensing](https://openvpn.net/as-docs/v3/azure-deploy.md).

> **Note**
>
> This guide applies specifically to **Azure Tiered** deployments. The licensing workflow for Azure PAYG and BYOL is different.

## Only two connections

If you purchased an Azure Tiered instance with more than two connections but Access Server allows only two, the server isn't successfully validating the Azure Tiered license.

When Access Server can't verify its license, it operates in demonstration mode, which limits the server to two concurrent connections.

Start by checking whether the VM reports the expected Azure Tiered Marketplace plan.

1. Connect to the Access Server VM with SSH and get root privileges.
2. Run the following to check communication with the Instance Metadata Service (IMDS):

   ```
   curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance/compute/plan?api-version=2025-04-07&format=json"
   ```

   The `--noproxy "*"` option ensures the request connects directly to IMDS instead of using a configured web proxy.

   `169.254.169.254` is the Azure IMDS address. The request uses the `2025-04-07` API version used by Access Server.
3. Review the output. A healthy Azure Tiered instance returns a plan object similar to:

   ```
   {
     "name": "5-connections-arm64",
     "product": "openvpn-as-tiered",
     "publisher": "openvpn"
   }
   ```

   The name value varies by connection tier and architecture.
4. Continue based on the result:
   - If the output includes `"product": "openvpn-as-tiered"` and `"publisher": "openvpn"`, but Access Server still allows only two connections, refer to [Azure metadata errors appear in the Access Server log](https://openvpn.net/as-docs/azure-license-troubleshooting/#azure-metadata-errors-appear-in-the-access-server-log).
   - If the expected plan information isn't returned, refer to [IMDS doesn't return the Azure Tiered plan](https://openvpn.net/as-docs/azure-license-troubleshooting/#imds-doesn-t-return-the-azure-tiered-plan).

## IMDS doesn't return the Azure Tiered plan

If the IMDS query doesn't return the expected Azure Tiered plan information, check for something on the VM or in its Azure configuration that is preventing access to IMDS.

IMDS is available from inside the VM at:

```
http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07
```

To troubleshoot the connection:

1. **Check proxy settings:** Requests to `169.254.169.254` need to bypass any configured web proxy. The troubleshooting command uses `--noproxy "*"` for this reason.
2. **Check routing:** Run:

   ```
   ip route get 169.254.169.254
   ```

   Verify that the route uses the VM's primary network interface and primary IP address. If you've customized the VM's routes, ensure `169.254.169.254` is still routed through the primary interface.
3. **Check local firewall rules:** Review both iptables and nftables for rules that block outbound TCP port 80 to `169.254.169.254`.
4. **Check endpoint security or network inspection software:** Ensure it isn't blocking or intercepting the IMDS request.
5. **Check the Azure network security group (NSG):** Standard NSG rules don't normally block IMDS. Check for any explicit deny rule that targets Azure IMDS traffic, such as the `AzurePlatformIMDS` service tag.
6. Run the IMDS query again:

   ```
   curl -s -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance/compute?api-version=2025-04-07" | jq .plan
   ```
7. When the expected Tiered plan information displays, restart Access Server:

   ```
   systemctl restart openvpnas
   ```
8. Sign in to the Admin Web UI and verify the connection limit.

If the IMDS query succeeds but Access Server still allows only two connections, continue with [Azure metadata errors appear in the Access Server log](https://openvpn.net/as-docs/azure-license-troubleshooting/#azure-metadata-errors-appear-in-the-access-server-log).

## Azure metadata errors appear in the Access Server log

Use Azure licensing debug logging when IMDS returns the expected Tiered plan but Access Server still doesn't recognize the license, or when you're investigating Azure-related errors in the Access Server log.

### Enable Azure licensing debug logging

1. Refer to [Debug Flags](https://openvpn.net/as-docs/v3/tutorials/tutorial--debug-flags.md) and follow the instructions on enabling Access Server debug flags.
2. For Azure, specifically, add:

   ```
   DEBUG_AZUREINFO=1
   ```
3. Restart Access Server as described in the debug flag tutorial.
4. Reproduce the licensing issue.
5. Review:

   ```
   /var/log/openvpnas.log
   ```
6. Search for Azure-related messages:

   ```
   grep -Ei "AZURE INFO|AZURE INSTANCE|AZURE not detected|consecutive failures" /var/log/openvpnas.log
   ```
7. Remove the debug flag when you're finished troubleshooting.

### Check for metadata connection errors

If Access Server can't retrieve the Azure metadata it expects, you may see errors such as:

```
AZURE INFO STATUS 502
AZURE INFO CONTENT (b'{"reason": "Could not connect to Node"}',)
```

You may also see:

```
AZURE not detected (missing instance/attested)
AZURE INFO: consecutive failures = 1/4
```

These messages indicate a problem retrieving the Azure information Access Server expects.

If you see these errors:

1. Run the IMDS query from [Only two connections](https://openvpn.net/as-docs/azure-license-troubleshooting/#only-two-connections) again.
2. Confirm that the result includes:

   ```
   "product": "openvpn-as-tiered"
   ```
3. If it doesn't, follow [IMDS doesn't return the Azure Tiered plan](https://openvpn.net/as-docs/azure-license-troubleshooting/#imds-doesn-t-return-the-azure-tiered-plan).
4. After restoring IMDS access, restart Access Server:

   ```
   systemctl restart openvpnas
   ```
5. Review `/var/log/openvpnas.log` again and confirm the metadata errors no longer appear.

> **Note**
>
> `consecutive failures = 1/4` shows that Access Server is tracking consecutive failures while retrieving Azure information. Use the surrounding log entries to identify the underlying problem.

### The connection limit is still incorrect

If Access Server still shows the wrong connection limit after the IMDS query succeeds and you've restarted the service:

1. Keep the Azure debug output from `/var/log/openvpnas.log`.
2. Contact OpenVPN support. Include:
   - The Azure connection tier you purchased.
   - The output from the IMDS plan query.
   - Relevant `DEBUG_AZUREINFO=1` entries from `/var/log/openvpnas.log`.
   - Any recent firewall, proxy, endpoint security, NSG, or networking changes.

## Change from Azure Tiered to another licensing model

Azure Tiered uses a fixed connection tier. If you need more flexibility to change the number of connections, migrate to Azure PAYG or an Access Server Subscription.

Refer to [Migrate Azure Tiered](https://openvpn.net/as-docs/v3/tutorials/tutorial--migrate-azure-tiered-to-payg-or-subscription.md).

## Related resources

- [Azure Tiered guide](https://openvpn.net/as-docs/v3/azure-tiered.md)
- [Azure licensing](https://openvpn.net/as-docs/v3/azure-deploy.md)
- [Debug Flags](https://openvpn.net/as-docs/v3/tutorials/tutorial--debug-flags.md)
- [License Types](https://openvpn.net/as-docs/v3/license-types.md)
- [Azure FAQ](https://openvpn.net/as-docs/faq-azure.md)
- [AWS license troubleshooting](https://openvpn.net/as-docs/aws-license-troubleshooting.md)
- [Subscription license troubleshooting](https://openvpn.net/as-docs/subscription-license-troubleshooting.md)
- [Fixed license troubleshooting](https://openvpn.net/as-docs/fixed-license-troubleshooting.md)

---

Prev: [AWS License](https://openvpn.net/as-docs/aws-license-troubleshooting.md)
Next: [Configuration](https://openvpn.net/as-docs/configuration-troubleshooting.md)
Index: https://openvpn.net/as-docs/llms.txt