In the Step_by_Step_guide_to_set_up_Site-to-Site_VPN_using_Cisco_ASA.docx document there is a mistake that caused me several days of troubleshooting.
The example azure virtual network "Azure_Virtual_NW" has an address space of 10.0.0.0/16, which has a subnet named "AzureVnet" in the example with address space of 10.0.0.0/24
Then in the Cisco ASA configuration portion, the object-group "azure-networks" is defined as the address range 10.0.0.0/24:
object-group network azure-networks
description Azure-Virtual-Network
network-object 10.0.0.0 255.255.255.0
exit
This lead me to believe that the Azure-side advertises its address space as the subnet 10.0.0.0/24. However with this configuration you will get you phase II failures with "crypto map policy not found" errors on the ASA side, because the Azure side actually advertises its entire virtual network address space (10.0.0.0/16). As was discovered by seeing azure's "remote IP Proxy Subnet data Payload" in the ASA's log (public ip obfuscated):
7|Oct 14 2016|22:46:14|713035|||||Group = 13.X.X.X, IP = 13.X.X.X, Received remote IP Proxy Subnet data in ID Payload: Address 10.0.0.0, Mask 255.255.0.0, Protocol 0, Port 0
7|Oct 14 2016|22:46:14|714011|||||Group = 13.X.X.X, IP = 13.X.X.X, ID_IPV4_ADDR_SUBNET ID received--10.0.0.0--255.255.0.0
object-group network azure-networks
description Azure-Virtual-Network
network-object 10.0.0.0 255.255.0.0
exit