An Azure virtual machine gives you operating-system control on Azure-managed hardware. Choose it when you need OS-level compatibility, custom agents, or software that does not fit a managed platform. You remain responsible for patching, hardening, endpoint protection, application deployment, capacity, and much of availability and recovery.
Lab: 45–60 minutes · Cost: VM, managed disk, IP, Bastion, backup, and logs can all charge · Safety: enable auto-shutdown and delete the complete group after testing.
Use the Azure pricing calculator and current size availability. A small name does not guarantee the lowest total cost.
Ways to build
Choose the Azure tool you want to use. The underlying resource stays the same.
Search Virtual machines → Create → Azure virtual machine. Select the learning resource group, region, availability option, supported Linux image, small eligible size, SSH public key authentication, no public inbound ports, and an existing private subnet. Enable managed identity, boot diagnostics, monitoring appropriate to the lab, and auto-shutdown.
Use Azure Bastion or a controlled private connection rather than opening SSH or RDP to the internet. Bastion is a billable managed service; delete it after a temporary lab.
PowerShell uses New-AzVMConfig, Set-AzVMOperatingSystem, Set-AzVMSourceImage, Add-AzVMNetworkInterface, and New-AzVM. The portal's Export template can help you learn resource shape, but exported templates require review before reuse.
The OS disk contains the boot volume. Data disks store application data. Temporary disks can be lost during host operations and must never hold durable state. Disk snapshots are point-in-time copies but are not a full application-consistent backup strategy.
Azure Compute Gallery stores versioned images and application definitions for controlled replication and sharing. Build images with an automated pipeline, patch them, scan them, version them, and roll forward through scale sets rather than modifying anonymous “golden” VMs by hand.
Scale sets manage a group of similar VMs with autoscaling, health integration, and rolling upgrades. Use them for stateless or externally stateful workloads that need VM-level control. Define a health probe, safe upgrade policy, instance protection rules, and a load-balancing layer.
Autoscaling needs both scale-out and scale-in rules, cooldowns, minimum capacity, and application behavior that tolerates termination. CPU alone is often a weak business signal; queue depth or request concurrency may be better.
Production IaC should declare network, NSG, private IP, identity, VM/scale set, image reference, disk configuration, boot diagnostics, update policy, monitoring association, backup, and role assignments. Never place an administrator password in a template or state file. Use SSH keys, Entra login where supported, and just-in-time access.
Deleting only the VM can leave disks and networking. Deleting the isolated resource group is easier to verify.