Deploy and Manage Azure Compute Resources · Topic 2 of 5
Virtual Machines
AZ-104 virtual machines: creating a VM, sizes and resizing, managed disks and the temporary disk, encryption at host, and moving a VM to another group or region.
- 5 min
- Resizing restarts a VM. Deallocate first if the new size is not available on the current hardware.
- The temporary disk is not persistent. Data disks and the OS disk are.
- Disks can grow but not shrink.
What it is
A virtual machine (VM) gives you full control of an operating system running on Azure hardware. You choose the image, the size, the disks and the network, and you keep the machine patched.
This page covers creating a VM, changing its size and disks, encrypting it at the host and moving it. Availability and scale sets are on the next page.
How it works
Creating a VM
In the portal you choose the subscription and resource group, a name, the region, the image and the size. You then set the administrator account, using an SSH key for Linux or a password for Windows, the disks, and the virtual network and network security group.
az vm create --resource-group rg-app --name vm-web01 --image Ubuntu2204 --size Standard_B2s --admin-username azureuser --generate-ssh-keysPowerShell uses New-AzVM for the same job.
Sizes
A size sets the number of CPU cores, the memory and the network and disk limits. Sizes come in families, for example general purpose, compute optimized, memory optimized, storage optimized and GPU.
You can change the size of a running VM from the Size page, and the VM restarts. If the new size is not available on the hardware where the VM currently runs, you must stop and deallocate the VM first so that it can move.
Disks
| Disk | Purpose |
|---|---|
| OS disk | Holds the operating system |
| Data disks | Hold application data and persist independently |
| Temporary disk | Local, fast scratch space. Its content can be lost when the VM moves, redeploys or is deallocated |
Managed disk types are Standard HDD, Standard SSD, Premium SSD, Premium SSD v2 and Ultra Disk, from lowest to highest performance. You can increase the size of a disk but you cannot shrink it. Never keep data you need on the temporary disk.
Encryption at host
Every managed disk is encrypted at rest by default. Encryption at host goes further: the data on the VM host, including the temporary disk and disk caches, is encrypted and stays encrypted as it flows to storage.
- It must first be enabled for the subscription by registering the feature.
- It is then turned on for a VM, and an existing VM must be deallocated to change it.
- It works with platform managed keys or with customer managed keys through a disk encryption set.
It is different from Azure Disk Encryption, which uses BitLocker or dm-crypt inside the guest operating system.
Moving a VM
| Move to | How |
|---|---|
| Another resource group or subscription | Use Move in the portal. Choose the VM and its related resources, such as its disks and network interface, and validate first |
| Another region | Use Azure Resource Mover, or replicate with Site Recovery, because a normal move cannot change the region |
A move to another resource group or subscription keeps the VM in the same region, and the target subscription must be in the same tenant.
VM states and billing
The state of a VM decides what you pay for.
| State | Compute billed | Notes |
|---|---|---|
| Running | Yes | The VM is on |
| Stopped from inside the guest | Yes | The hardware is still reserved |
| Stopped (deallocated) | No | The hardware is released. Disks and static IPs are still billed |
To stop compute charges, deallocate the VM from the portal or CLI. Shutting down from inside the operating system does not do this.
Comparing the encryption options
| Option | What it protects |
|---|---|
| Server side encryption | Disks at rest on the storage service, on by default |
| Azure Disk Encryption | Disk contents inside the guest, using BitLocker or dm-crypt |
| Encryption at host | Data on the host, including temporary disks and caches, flowing to storage |
VM extensions
An extension adds software or configuration to a VM after it is created. The Custom Script Extension, for example, downloads and runs a script, so a new VM can install a web server by itself. Extensions are also how monitoring and backup agents are installed.
Resizing steps
- Open the VM and choose Size.
- Pick a new size from the list of those available.
- Confirm. The VM restarts.
- If the size is not listed, deallocate the VM first and try again.
How the exam asks about this
- "Stop paying for compute." Deallocate the VM.
- "Keep data safe on a VM." Use a data disk, not the temporary disk.
- "Encrypt the temporary disk." Encryption at host.
- "Run a script when the VM is created." The Custom Script Extension.
- "Move a VM to another region." Azure Resource Mover or Site Recovery.
What to remember for the exam
- Resizing restarts a VM. Deallocate first if the new size is not available on the current hardware.
- The temporary disk is not persistent. Data disks and the OS disk are.
- Disks can grow but not shrink.
- Encryption at host covers the host, temporary disk and caches. The feature must be registered for the subscription.
- Azure Disk Encryption works inside the guest with BitLocker or dm-crypt.
- A change of region uses Azure Resource Mover or Site Recovery. A change of group or subscription uses Move.
"Encrypt the temporary disk and caches" points to encryption at host, not Azure Disk Encryption.
Common mistakes
Storing data on the temporary disk. It can be erased when the VM moves or is deallocated.
Trying to shrink a disk. Create a new smaller disk and copy the data.
Moving a VM to another region with the normal Move. Use Resource Mover or Site Recovery.
Forgetting to register the encryption at host feature. The option stays unavailable.
Check yourself
Which VM disk can lose its data when the VM is deallocated or redeployed?
The temporary disk.
What encrypts the temporary disk and disk caches on the VM host?
Encryption at host.
Which service moves a VM to another region?
Azure Resource Mover, or Azure Site Recovery.
Topic 2 of 5 in Deploy and Manage Azure Compute Resources
Test yourself on Deploy and Manage Azure Compute Resources
The full Microsoft AZ-104 question bank has 650 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.