Azure Virtual Machines: Deploy, Configure and Manage VMs

Overview

This tutorial provides cloud engineers and AZ-104 certification candidates with practical, step-by-step guidance for working with Azure Virtual Machines (VMs). You will learn to deploy VMs using the Azure CLI, configure networking and storage, manage VM lifecycle, and implement best practices aligned with Azure Administrator responsibilities.

Prerequisites:

An active Azure subscription
Azure CLI installed (version 2.40+)
Basic understanding of cloud computing and networking concepts
Familiarity with Linux/bash command line

Why This Matters for AZ-104: VM deployment and management accounts for approximately 25-30% of the Azure Administrator exam. Understanding resource groups, virtual networks, storage accounts, and VM scaling is critical for passing the certification and managing Azure infrastructure in production environments.

Getting Started

Before deploying VMs, ensure Azure CLI is installed and authenticated to your subscription.

Install Azure CLI:

curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

Verify installation and sign in:

az --version
az login

Your default subscription will be used. To list available subscriptions:

az account list --output table

To switch to a specific subscription:

az account set --subscription "subscription-id-or-name"

Create a resource group (required for all resources):

az group create --name myResourceGroup --location eastus

Creating and Deploying Azure Virtual Machines

Azure VMs are compute resources that provide on-demand, scalable computing with support for Windows and Linux operating systems. The simplest way to create a VM is using the az vm create command, which automatically provisions networking and storage resources.

Deploy a basic Ubuntu VM with SSH key authentication:

az vm create \
  --resource-group myResourceGroup \
  --name myVM \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard \
  --size Standard_B2s

This command creates:

A Virtual Machine named "myVM"
A Virtual Network and Subnet (default configuration)
A Network Security Group (NSG) with SSH access enabled
A Public IP address for remote access
SSH key pairs stored in ~/.ssh/

Common Pitfall: Forgetting to specify --generate-ssh-keys or --admin-password will fail the VM creation. SSH keys are strongly recommended over passwords for Linux VMs in production.

Verify VM creation and retrieve connection details:

az vm show --resource-group myResourceGroup --name myVM --query publicIps --output tsv

Connect to your VM via SSH:

ssh -i ~/.ssh/id_rsa azureuser@

Configuring Networking and Security

Proper networking configuration is essential for VM security and communication. Network Security Groups (NSGs) act as distributed firewalls controlling inbound and outbound traffic.

Create a Network Security Group with custom rules:

az network nsg create \
  --resource-group myResourceGroup \
  --name myNSG

Add inbound rules to allow HTTP and HTTPS traffic:

az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name AllowHTTP \
  --protocol tcp \
  --priority 100 \
  --destination-port-ranges 80 \
  --access Allow

az network nsg rule create \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --name AllowHTTPS \
  --protocol tcp \
  --priority 110 \
  --destination-port-ranges 443 \
  --access Allow

Associate NSG with a network interface:

NIC_ID=$(az vm show --resource-group myResourceGroup --name myVM --query networkProfile.networkInterfaces[0].id -o tsv)
az network nic update --ids $NIC_ID --network-security-group myNSG

Best Practice: Always follow the principle of least privilege. Only open ports necessary for your application. Use specific IP ranges instead of 0.0.0.0/0 when possible.

View all NSG rules for a VM:

az network nsg rule list \
  --resource-group myResourceGroup \
  --nsg-name myNSG \
  --query "[].{Name:name, Protocol:protocol, Priority:priority, Access:access}" \
  --output table

Managing VM Lifecycle and Advanced Operations

VM lifecycle management includes starting, stopping, deallocating, and removing instances. Understanding the difference between stop and deallocate is critical for cost optimization.

Stop vs. Deallocate:

Stop: VM remains allocated (compute resources reserved). You continue paying for compute.
Deallocate: VM is powered off and compute resources released. You only pay for storage.

Deallocate a VM to reduce costs:

az vm deallocate \
  --resource-group myResourceGroup \
  --name myVM

Start a deallocated VM:

az vm start \
  --resource-group myResourceGroup \
  --name myVM

Restart a VM (useful for applying updates):

az vm restart \
  --resource-group myResourceGroup \
  --name myVM

Resize a VM (must be deallocated first):

az vm deallocate --resource-group myResourceGroup --name myVM
az vm resize --resource-group myResourceGroup --name myVM --size Standard_B4ms
az vm start --resource-group myResourceGroup --name myVM

Delete a VM and associated resources:

az vm delete --resource-group myResourceGroup --name myVM --yes

Common Pitfall: Forgetting to deallocate before resizing can cause failures. Always deallocate first for size changes requiring hardware reallocation.

List all VMs in a resource group with details:

az vm list --resource-group myResourceGroup --query "[].{Name:name, Status:powerState, VMSize:hardwareProfile.vmSize}" --output table

Configure automatic shutdown to save costs:

az vm auto-shutdown --resource-group myResourceGroup --name myVM --time 19:00

Exam Tips for Azure Administrator (AZ-104)

Key Concepts on the Exam:

VM sizing and compute options: Understand B-series (burstable), D-series (general purpose), E-series (memory optimized), and F-series (compute optimized)
Managed vs. Unmanaged Disks: Microsoft recommends managed disks for automatic storage account management
Availability Sets and Zones: Know the difference between availability sets (logical grouping) and availability zones (physical separation)
Scale Sets: Virtual Machine Scale Sets auto-scale based on metrics like CPU usage
Spot VMs: Cost-effective option for non-critical workloads (up to 90% discount)

Common Exam Scenarios:

"A company needs to reduce costs for non-production VMs. Which feature should they use?" → Answer: Deallocate when not in use, or use Spot VMs
"You need to ensure a VM survives hardware failures." → Answer: Deploy across availability zones or use availability sets
"Configure a VM to automatically shut down daily at 7 PM." → Use az vm auto-shutdown
"Migrate a VM to a different size." → Deallocate, resize, then start

Quick Reference Commands:

# Create VM with custom VNet
az vm create --resource-group rg --name vm1 --image Ubuntu2204 --vnet-name myVNet --subnet mySubnet

# Get VM public IP
az vm show-ip-address --resource-group rg --name vm1

# Update VM tags for billing
az vm update --resource-group rg --name vm1 --set tags.environment=production tags.owner=team-a

# Enable managed identity (for Azure services authentication)
az vm identity assign --resource-group rg --name vm1

# Open port in NSG
az vm open-port --resource-group rg --name vm1 --port 8080 --priority 100

Summary

Key Takeaways:

Azure VMs provide flexible compute with automatic networking and storage provisioning
Use SSH keys instead of passwords for Linux VM authentication
Always use deallocate instead of stop to minimize costs when VMs aren't needed
Network Security Groups control traffic; follow least privilege principles
Understand the difference between availability sets, zones, and scale sets for high availability
Use --query and --output table flags to efficiently retrieve information

Next Steps:

Practice deploying VMs across multiple availability zones
Explore Virtual Machine Scale Sets for auto-scaling scenarios
Study Azure Backup and disaster recovery options
Review AZ-104 official Microsoft learning modules on VM management

For additional Azure Administrator resources, visit CloudNinjas.ca certification guides and labs.