Azure Virtual MachinesAuthorCloudBrum editorial teamLast reviewed21 Oct 2026Reading time~12 minLevelBeginner to advanced

• Wide choice of VM sizesSeries for everyday, compute-heavy, memory-heavy and storage-heavy jobs, plus GPU and HPC (high-performance computing) options.
• ImagesCreate VMs from Azure Marketplace, from your own images, or from versioned images shared through Azure Compute Gallery.
• Managed disksChoose Premium SSD, Premium SSD v2, Standard SSD or Ultra Disk for persistent data, and use the local temporary disk for scratch files.
• Scale sets and load balancingVirtual Machine Scale Sets add and remove identical VMs automatically behind Azure Load Balancer or Application Gateway.
• Zones and ArmSpread VMs over Availability Zones for resilience, or run Arm-based sizes (Ampere Altra, Microsoft Cobalt 100) for better price-performance.
• Flexible ways to payPay-as-you-go, reservations, a compute savings plan, Spot VMs and Azure Hybrid Benefit for licences you already own.
• Network and access controlVirtual networks, NSGs, Azure Bastion, managed identities and sign-in with Microsoft Entra ID.
• Fine-grained billingPay-as-you-go compute is charged per second, and deallocating a VM ends its compute charges.

Virtual machine (VM)

A server you create in Azure. Compute is billed for as long as the VM stays allocated, whether or not anything is running on it.

Image

The starting contents of a VM’s disk: an Azure Marketplace image, a custom image, or a version stored in Azure Compute Gallery.

Size and series

The size sets vCPU, memory, network and disk limits, for example Standard_B2s or Standard_D4s_v5. Letters such as B, D, E, F, L and N name the series.

Region and Availability Zone

Regions are separate geographies. Where a region offers zones, each zone is a distinct datacentre location, so VMs in different zones survive the loss of one.

Resource group

A folder-like container for resources that share a life cycle, such as a VM with its disks, network card and public IP. Deleting the group deletes them all.

Virtual network (VNet) and subnet

Your private address space in Azure, divided into subnets where VM network interfaces receive their private IP addresses.

Network security group (NSG)

A list of prioritised allow and deny rules. It is stateful, and you attach it to a subnet, a network interface, or both.

Managed disk

Azure-managed block storage. Each VM has an OS disk, may have data disks, and on many sizes also a temporary disk that does not survive redeployment.

Managed identity

A Microsoft Entra ID identity tied to the VM, so code on the machine can call Azure services without passwords or keys in configuration files.

Custom data and cloud-init

A script or settings file handed to the VM at first boot. Treat it as readable by anyone with access to the VM, so keep secrets out.

Instance Metadata Service (IMDS)

A non-routable endpoint on 169.254.169.254 where a VM reads facts about itself and requests managed identity tokens.

Create a VM in the Azure portal

1. Open Virtual machinesIn the Azure portal search for Virtual machines, select Create, then Azure virtual machine, and confirm the subscription.
2. Fill in the basicsCreate or pick a resource group, name the VM, choose a region near your users, and add tags like Env and Owner for cost tracking.
3. Decide on availability and security typeChoose an Availability zone for production, or No infrastructure redundancy required for dev/test. Leave the security type on Trusted launch virtual machines.
4. Select the image and sizeUbuntu Server 24.04 LTS and Windows Server 2022 are common starting points. Begin with a modest size such as Standard_B2s; resizing is easy once you have metrics.
5. Set up sign-inFor Linux use SSH public key and let Azure create the key pair. For Windows use a strong password. Better still, enable Login with Microsoft Entra ID on the Management tab.
6. Close the inbound portsSet Public inbound ports to None and reach the VM through Azure Bastion. Where SSH or RDP must stay open, limit the source to your own addresses in the NSG.
7. Choose the disksPremium SSD fits production and Standard SSD fits dev/test. Switch on Encryption at host (Advanced tab) if your subscription has the feature registered.
8. Wire up networking and managementPick the VNet and subnet, set the public IP to None for a private VM, enable a system-assigned managed identity, auto-shutdown for non-production, and Azure Backup.
9. Review, create and connectWhen deployment finishes, connect with Azure Bastion, or SSH from a host inside your network.

• Measure before resizing. Azure Monitor metrics and Azure Advisor show real CPU, memory and disk pressure.
• Prefer recent generations. Newer series in each family usually deliver more per unit of cost; test Arm sizes if your stack runs on Arm.
• Match the disk tier to the I/O. Premium SSD v2 lets you dial capacity, IOPS and throughput separately; Ultra Disk targets the most latency-sensitive databases; keep the temporary disk for throwaway files.
• Enable accelerated networking on sizes that support it for lower latency and higher throughput.
• Group chatty VMs in a proximity placement group to keep network hops short.
• Mind B-series credits. Burstable VMs slow down when credits run out, so move constant load to D or F series.
• Scale out, not just up. Use scale sets behind a load balancer and put Azure Front Door or a CDN in front for static content.
• Choose the region for your users. Latency follows distance, and the zone layout decides how well you ride out a datacentre failure.

FinOps is the habit of managing cloud spend together with engineering. These are the FinOps checks that matter most for Azure Virtual Machines.

• Commit where usage is steady. Reservations and the compute savings plan lower the hourly rate in return for a 1 or 3-year promise (Microsoft quotes up to about 72% for reservations and about 65% for the savings plan).
• Run interruptible jobs on Spot VMs, such as batch, CI and stateless workers (up to about 90% below pay-as-you-go, according to Microsoft).
• Bring licences you already own. Azure Hybrid Benefit applies eligible Windows Server and SQL Server licences with Software Assurance, plus some Linux subscriptions.
• Act on Advisor. Shrink the VMs it flags as underused.
• Turn dev and test off after hours with auto-shutdown or a start/stop schedule.
• Deallocate instead of shutting down. A VM stopped inside the OS still accrues compute charges.
• Sweep for leftovers: unattached managed disks, aged snapshots, unused public IPs and idle NAT gateways.
• Right-tier the disks. Standard SSD suits dev/test; with Premium SSD v2 you pay only for the capacity and performance you provision.
• Watch traffic charges. Data leaving Azure or crossing regions adds up, so keep chatty components together.
• Tag and budget. Set budgets and anomaly alerts in Microsoft Cost Management.

• Give VMs a managed identity instead of storing passwords or access keys on disk.
• Reach VMs through Azure Bastion or just-in-time access, and skip public IPs on private machines.
• Sign in with Microsoft Entra ID, backed by MFA and Conditional Access.
• Write narrow NSG rules, using application security groups and service tags rather than broad address ranges.
• Keep application VMs in private subnets: inbound traffic arrives through a load balancer or Application Gateway, and outbound traffic leaves through NAT Gateway or Azure Firewall.
• Leave Trusted launch (secure boot and vTPM) on, and look at Confidential VMs when data must stay encrypted while it is processed.
• Enable encryption at host, and use customer-managed keys in Key Vault where policy demands it.
• Patch with Azure Update Manager and assess weaknesses with Microsoft Defender for Cloud.
• Send logs to Azure Monitor through the Azure Monitor Agent, and keep the Activity log and virtual network flow logs switched on.
• Keep credentials in Azure Key Vault, never in custom data.
• Build from hardened, approved images in Azure Compute Gallery and refresh them regularly.

For audit trails rely on the Azure Activity log; for retention use Azure Backup policies; for evidence, the Defender for Cloud compliance view together with the Service Trust Portal provides downloadable reports. Azure’s SOC, ISO 27001, PCI DSS and HIPAA attestations (among others) cover the platform. Whether your own workload complies depends on how the VM is configured, patched and used.

• Resize, then deallocate idle VMs. A machine that is off adds no compute emissions of its own.
• Choose efficient silicon. Arm-based sizes often finish the same work on less power.
• Prefer cleaner regions whenever latency and data-residency rules leave you a choice.
• Let autoscale follow demand rather than sizing for the daily peak.
• Soak up spare capacity with Spot VMs for work that can wait or restart.
• Look at PaaS and serverless for bursty workloads; shared platforms pack work more tightly.
• Track the numbers. Use carbon optimization in the Azure portal and Microsoft’s emissions reporting to estimate your footprint, and confirm which tool is current for your tenant.

Purchase options

What you actually pay for

• Hours the VM stays allocated, priced by size, OS and region and then lowered by any reservation, savings plan or Spot discount
• Managed disks, priced by tier and size with extra charges for provisioned IOPS or throughput, plus snapshots
• Data that leaves Azure or moves between regions
• Network add-ons such as public IPs, Standard Load Balancer, NAT Gateway and Azure Bastion
• Licences for Windows Server, SQL Server, RHEL or SUSE where they apply (Azure Hybrid Benefit can reduce them)

Create a small Linux VM with Trusted launch, SSH key sign-in, a managed identity and no public IP. Replace the placeholder names with your own.

# Create a resource group and one Linux VM (no public IP)
az group create --name rg-demo-dev --location centralindia

az vm create \
  --resource-group rg-demo-dev \
  --name vm-demo-01 \
  --image Canonical:ubuntu-24_04-lts:server:latest \
  --size Standard_B2s \
  --zone 1 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --vnet-name vnet-demo --subnet snet-app \
  --public-ip-address "" \
  --nsg-rule NONE \
  --security-type TrustedLaunch --enable-secure-boot true --enable-vtpm true \
  --assign-identity [system] \
  --storage-sku Premium_LRS --os-disk-size-gb 30 \
  --tags Env=dev Owner=platform-team
# Add --encryption-at-host true once the EncryptionAtHost feature is registered on the subscription

# List the VMs with their state
az vm list --resource-group rg-demo-dev --show-details \
  --query "[].{Name:name,Size:hardwareProfile.vmSize,State:powerState,PrivateIP:privateIps}" \
  --output table

# Stop billing for compute: deallocate, do not just shut down inside the OS
az vm deallocate --resource-group rg-demo-dev --name vm-demo-01

# Assumes a resource group and a network interface (no public IP) are defined elsewhere
resource "azurerm_linux_virtual_machine" "demo" {
  name                  = "vm-demo-01"
  resource_group_name   = azurerm_resource_group.demo.name
  location              = azurerm_resource_group.demo.location
  size                  = "Standard_B2s"
  zone                  = "1"
  admin_username        = "azureuser"
  network_interface_ids = [azurerm_network_interface.demo.id]

  admin_ssh_key {
    username   = "azureuser"
    public_key = file("~/.ssh/id_ed25519.pub")
  }

  identity {
    type = "SystemAssigned"
  }

  secure_boot_enabled = true    # Trusted launch
  vtpm_enabled        = true

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Premium_LRS"
    disk_size_gb         = 30
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "ubuntu-24_04-lts"
    sku       = "server"
    version   = "latest"
  }

  tags = {
    Env   = "dev"
    Owner = "platform-team"
  }
}

# pip install azure-identity azure-mgmt-compute
from azure.identity import DefaultAzureCredential
from azure.mgmt.compute import ComputeManagementClient

subscription_id = "00000000-0000-0000-0000-000000000000"
compute = ComputeManagementClient(DefaultAzureCredential(), subscription_id)

poller = compute.virtual_machines.begin_create_or_update(
    "rg-demo-dev",
    "vm-demo-01",
    {
        "location": "centralindia",
        "zones": ["1"],
        "hardware_profile": {"vm_size": "Standard_B2s"},
        "storage_profile": {
            "image_reference": {
                "publisher": "Canonical", "offer": "ubuntu-24_04-lts",
                "sku": "server", "version": "latest",
            },
            "os_disk": {
                "create_option": "FromImage", "disk_size_gb": 30,
                "managed_disk": {"storage_account_type": "Premium_LRS"},
            },
        },
        "os_profile": {
            "computer_name": "vm-demo-01",
            "admin_username": "azureuser",
            "linux_configuration": {
                "disable_password_authentication": True,
                "ssh": {"public_keys": [{
                    "path": "/home/azureuser/.ssh/authorized_keys",
                    "key_data": "ssh-ed25519 AAAA... you@example.com",
                }]},
            },
        },
        "network_profile": {"network_interfaces": [{"id": "/subscriptions/<subscription-id>/resourceGroups/rg-demo-dev/providers/Microsoft.Network/networkInterfaces/nic-demo-01"}]},
        "security_profile": {
            "security_type": "TrustedLaunch",
            "uefi_settings": {"secure_boot_enabled": True, "v_tpm_enabled": True},
        },
        "identity": {"type": "SystemAssigned"},
        "tags": {"Env": "dev"},
    },
)
vm = poller.result()
print(vm.id)

// dotnet add package Azure.Identity
// dotnet add package Azure.ResourceManager.Compute
using Azure;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager;
using Azure.ResourceManager.Compute;
using Azure.ResourceManager.Compute.Models;
using Azure.ResourceManager.Models;
using Azure.ResourceManager.Resources;

var arm = new ArmClient(new DefaultAzureCredential());
SubscriptionResource subscription = await arm.GetDefaultSubscriptionAsync();
ResourceGroupResource group = await subscription.GetResourceGroupAsync("rg-demo-dev");

var vm = new VirtualMachineData(new AzureLocation("centralindia"))
{
    HardwareProfile = new VirtualMachineHardwareProfile { VmSize = VirtualMachineSizeType.StandardB2S },
    StorageProfile = new VirtualMachineStorageProfile
    {
        ImageReference = new ImageReference { Publisher = "Canonical", Offer = "ubuntu-24_04-lts", Sku = "server", Version = "latest" },
        OSDisk = new VirtualMachineOSDisk(DiskCreateOptionType.FromImage)
        {
            DiskSizeGB = 30,
            ManagedDisk = new VirtualMachineManagedDisk { StorageAccountType = StorageAccountType.PremiumLrs }
        }
    },
    OSProfile = new VirtualMachineOSProfile
    {
        ComputerName = "vm-demo-01",
        AdminUsername = "azureuser",
        LinuxConfiguration = new LinuxConfiguration { DisablePasswordAuthentication = true }
    },
    SecurityProfile = new SecurityProfile
    {
        SecurityType = SecurityType.TrustedLaunch,
        UefiSettings = new UefiSettings { IsSecureBootEnabled = true, IsVirtualTpmEnabled = true }
    },
    Identity = new ManagedServiceIdentity(ManagedServiceIdentityType.SystemAssigned),
    Zones = { "1" },
    Tags = { ["Env"] = "dev" }
};
vm.OSProfile.LinuxConfiguration.SshPublicKeys.Add(new SshPublicKeyConfiguration
{
    Path = "/home/azureuser/.ssh/authorized_keys",
    KeyData = "ssh-ed25519 AAAA... you@example.com"
});
vm.NetworkProfile = new VirtualMachineNetworkProfile();
vm.NetworkProfile.NetworkInterfaces.Add(new VirtualMachineNetworkInterfaceReference
{
    Id = new ResourceIdentifier("/subscriptions/<subscription-id>/resourceGroups/rg-demo-dev/providers/Microsoft.Network/networkInterfaces/nic-demo-01")
});

ArmOperation<VirtualMachineResource> op = await group.GetVirtualMachines()
    .CreateOrUpdateAsync(WaitUntil.Completed, "vm-demo-01", vm);
Console.WriteLine(op.Value.Id);

Short walkthrough videos for this service are being prepared. They will appear here and load only when you press play. Until then, follow CloudBrum on YouTube for new videos.

Not sure virtual machines are the right level? Compare with Azure App Service (managed web hosting), Azure Functions (serverless functions), Azure Container Apps and Azure Kubernetes Service (containers).