Deploying Your First VM in Azure: From Zero to a Running Server
A beginner-friendly walkthrough of creating, securing, connecting to, monitoring and safely cleaning up your first Azure virtual machine, with every term explained in plain words.
Imagine you want to open a small shop, but you do not own any land. Instead of buying a building, you rent a unit in a large, well-guarded shopping mall. You choose the size of the unit, decide what kind of lock to put on the door, bring in your furniture, and pay only while the unit is yours. When you no longer need it, you hand back the keys and the rent stops. The mall owner takes care of the roof, the electricity supply and the security guards at the gate.
An Azure virtual machine works the same way. Instead of buying a physical computer, you rent a computer from Microsoft’s data centers, choose its size and operating system, and use it from anywhere. In this guide, we will deploy your very first virtual machine from the beginning. You do not need any earlier cloud experience. Every new word will be explained the first time it appears, with a simple comparison from everyday life, so that you finish with a working, safe and sensibly priced machine, and you know exactly why each choice was made.
1What Is a Virtual Machine?
A virtual machine is a complete computer that exists as software, running inside a much bigger physical computer.
A physical server is a real computer in a data center, with real processors, memory and disks. A virtual machine, usually shortened to VM, is a software copy of a computer that runs on such a server. It has its own operating system, its own programs and its own settings, and it behaves exactly like a real computer to anyone who uses it. One powerful physical server can host many VMs at the same time, each isolated from the others, like apartments in one building.
The special software that creates and manages VMs on a physical server is called a hypervisor. Azure uses a hypervisor technology from Microsoft to share its hardware safely among many customers. You never see or manage the hypervisor. You only see your own VM.
A large apartment building is the physical server. Each apartment is a virtual machine. Each family has its own front door, furniture and rules, and cannot walk into the neighbor’s apartment, even though they share the same building and the same foundation.
2Why Use Azure Virtual Machines?
VMs give you flexibility and control, with Microsoft handling the hardware.
No hardware to buy
You avoid purchasing, installing, powering and cooling servers. Microsoft maintains the data centers.
Pay for what you use
You are billed for the time the machine runs and the storage it holds, and can stop paying when you delete it.
Many choices
Choose Windows or Linux, small or huge sizes, and many ready-made software images.
Fast and repeatable
You can create the same machine again and again, or many copies, quickly.
Global reach
Place machines in regions close to your users around the world.
VMs are an infrastructure as a service, or IaaS, offering. This means Microsoft runs the hardware and the virtualization, while you run everything inside the machine: the operating system updates, security settings and applications. That gives you great control, but also more responsibility than with managed services such as web app hosting. For a first deployment, a VM is perfect for learning how cloud computing works.
Renting an unfurnished flat lets you arrange everything your own way, but you must clean it and fix the small things. Renting a hotel room gives you less freedom, but someone else does the cleaning. A VM is the flat; a managed service is the hotel room.
3Before You Begin: What You Need
A few small things must be ready before you click anything.
An Azure account and subscription
A subscription is the agreement under which you use and pay for Azure. If you are new, Microsoft has usually offered a free account with credits and some free monthly amounts of selected services for a limited period. Check the current offer on the official site.
Permission to create resources
Your account needs a role such as Contributor on the subscription or a resource group. If you work for a company, ask your administrator.
A decision about purpose
Write one sentence on what the machine is for, such as “a small Linux web server for learning” or “a Windows machine to test software”. Purpose decides size, system and security.
A way to connect
For Linux you will use a tool called SSH. For Windows you will use Remote Desktop. Both are explained later. Your computer already has these tools or can easily install them.
A budget and a cleanup plan
Decide how much you are willing to spend and set a reminder to delete the machine when you are done.
Before renting a shop unit, you bring your identity papers, your money, a plan of what you will sell and a lease end date. Preparation avoids confusion at the counter.
Before creating anything, open Cost Management and set a small monthly budget with email alerts. It is the cheapest insurance against forgetting a running machine.
4What Gets Created Together with a VM
A VM is never alone; several supporting resources are created with it.
Many beginners think that creating a VM makes one item. In reality, Azure creates a small family of connected resources. Understanding them helps you read your bill, secure your machine and clean up correctly.
flowchart TB
RG["Resource group: the folder holding everything"] --> VM["Virtual machine: the compute"]
RG --> OSD["OS disk: the machine's main drive"]
RG --> NIC["Network interface: the machine's network card"]
RG --> PIP["Public IP address: the internet address"]
RG --> NSG["Network security group: the firewall rules"]
RG --> VNET["Virtual network and subnet: the private network"]
VM --> OSD
VM --> NIC
NIC --> PIP
NIC --> NSG
NIC --> VNET
Resource group
A named folder that holds related resources, so you can manage and delete them together.
Virtual machine
The compute part: processor and memory, with your chosen operating system.
OS disk
A managed disk storing the operating system and files. Azure manages the underlying storage for you.
Network interface (NIC)
The virtual network card that connects the VM to a network.
Virtual network and subnet
A private network in Azure, divided into smaller parts called subnets, where your VM gets a private address.
Public IP address
An address reachable from the internet. It is optional but commonly created by default for beginners.
Network security group (NSG)
A set of allow and deny rules that act as a firewall for the network card or subnet.
Renting the shop unit also gives you a door, a lock, a street address and a notice board of who may enter. The unit alone is not enough; the supporting items make it usable and safe.
5The Journey from Click to Running Machine
Let us see what happens behind the scenes when you press Create.
sequenceDiagram
participant U as You in the portal
participant ARM as Azure Resource Manager
participant CP as Compute and network services
participant HV as Host server
U->>ARM: Submit the VM request
ARM->>ARM: Check permissions, quotas and policies
ARM->>CP: Create network, disk and VM resources
CP->>HV: Allocate capacity in the chosen region
HV->>HV: Copy image to disk and start the VM
HV-->>ARM: Report running
ARM-->>U: Deployment succeeded
Azure Resource Manager, often shortened to ARM, is the front door of all Azure management. Whether you use the portal, a command line or an automation tool, your request goes to Resource Manager, which checks that you are allowed to do it, that you have enough quota and that your organization’s policies permit it. It then asks the compute and network services to build the resources. The quota is a limit on how many cores or resources you can create in a region, protecting you and Azure from mistakes.
The reception desk of the mall checks your papers, confirms there is a free unit, and instructs the staff to prepare the unit, the keys and the signboard before handing you the key.
A simple VM usually becomes ready in a few minutes. If a deployment fails, the portal shows the reason, which is often a quota limit, an unavailable size in that region, or a policy block.
6Step 1: Start the Creation and Set the Basics
The first tab of the wizard asks who, where and what.
In the Azure portal, choose to create a new resource and select Virtual machine. A wizard with several tabs opens: Basics, Disks, Networking, Management, Monitoring, Advanced and Tags, followed by a Review and create step. Take them one at a time.
Subscription
Select the subscription that will pay for the machine.
Resource group
Create a new one with a clear name, such as “rg-learning-vm”. A dedicated group makes cleanup easy.
Virtual machine name
Choose a short, meaningful name. Azure naming rules limit length and some characters, and the name cannot be changed later without recreating the machine.
Region
The geographic location. Choose one near you or your users, check that it offers the size you want, and remember that prices differ by region.
Availability options
For a learning machine, no redundancy is fine. For important workloads, zones or scale sets protect against failures.
Security type
The modern default, called Trusted launch, adds protection against low-level attacks such as tampering during startup. Keep it unless your image does not support it.
This is the first page of a rental form. You write who is paying, which building, what name goes on the door, and which floor you prefer.
Putting the machine into a shared, long-lived resource group with other things. When you later want to delete only your experiment, you cannot do so safely. Give each experiment its own resource group.
7Step 2: Choose the Image (Operating System)
The image decides which operating system and software your machine starts with.
An image is a ready-made template of a disk containing an operating system and sometimes extra software. Azure offers many images from Microsoft and trusted publishers in the Marketplace, which is a catalog of ready-to-use images and services.
Linux images
Popular choices include Ubuntu Server, Red Hat Enterprise Linux, Debian, SUSE and others. Linux images are usually cheaper because many have no license fee, and they are managed with text commands over a secure connection called SSH. A good first choice for learning servers and web hosting.
Windows images
Windows Server and Windows client images are available. Windows images include a license cost in their price, unless you bring eligible licenses through Azure Hybrid Benefit. They are managed through a graphical desktop using Remote Desktop. A good first choice if you need Windows software.
Marketplace images
Images with pre-installed software such as web servers, databases or security appliances. Always check the publisher, the extra software charges and the reviews.
You also choose the architecture. Most beginners pick x64, the common type of processor. Some sizes use Arm-based processors, which can be cheaper and efficient, but need images and software built for Arm.
The image is the furnishing package of the rented unit: an empty shell, a basic office layout or a fully equipped kitchen. Choose the package that matches what you will do inside.
Choose a recent long-term support version of your operating system. Old versions may be out of support and no longer receive security updates.
8Step 3: Choose the Size
The size decides how powerful, and how expensive, your machine is.
A VM size fixes the number of virtual processor cores (vCPUs), the amount of memory (RAM), the speed of storage and network, and the hourly price. Sizes are grouped into families for different purposes.
| Family type | Good for | Beginner note |
|---|---|---|
| General purpose | Balanced processor and memory for web servers, small databases, development | The usual starting point |
| Burstable | Machines that are usually idle but sometimes need more power | Often the cheapest choice for learning and light use |
| Compute optimized | Processor-heavy tasks such as batch jobs and game servers | Not needed for a first VM |
| Memory optimized | Large databases and in-memory analytics | Not needed for a first VM |
| Storage optimized | High disk throughput such as big data | Specialist use |
| GPU | Graphics, machine learning, rendering | Expensive, and quota is often restricted |
For a first learning machine, a small general-purpose or burstable size is plenty. The free account may include a specific small size for a limited time, so check the current free offer and choose from its list if you want it free. If a size is greyed out or missing, it may not be available in your region or your quota may be zero, in which case you can try another region or request more quota.
Sizes are like car rental classes: small city car, family sedan, large van, sports car. You pay more for the larger vehicle, and you should not rent a van to carry one person to the shop.
Choosing a very large size “to be safe”. You can resize a VM later, so start small and watch real usage. Oversizing is the most common reason for a high first bill.
9Step 4: Set Up Authentication
Authentication proves that you are the rightful owner when you connect to the machine.
For a Linux VM, the recommended method is an SSH key pair. This consists of two linked files: a public key, which is placed on the VM like a lock, and a private key, which you keep safely like the only key. Anyone without the private key cannot enter, and there is no password to guess. In the portal, you can let Azure generate a key pair and download the private key file once. Store it securely and never share it.
For a Windows VM, you choose an administrator username and a strong password. Pick a long, unique password, and avoid common names such as “admin” or “administrator” for the user, because attackers try them first.
SSH key pair (Linux)
Much stronger than passwords. The private key never leaves your computer.
Password (Windows)
Use a long, random, unique password stored in a password manager.
Microsoft Entra ID sign-in
Supported for many Windows and Linux images. Lets you sign in with your work identity and use multifactor authentication and role-based access.
A password is like a code written on a card that others may guess or peek at. An SSH key is like a unique metal key cut for your lock. Without the physical key, nobody gets in.
If you lose it, you may be locked out and need recovery steps. If someone copies it, they can enter your machine. Keep it in a protected folder with restricted permissions.
10Step 5: Decide Which Doors to Open (Inbound Ports)
This small setting is one of the most important security decisions you will make.
A port is a numbered door on a computer through which a particular kind of traffic can enter. Remote administration of Linux uses port 22 (SSH), and Windows Remote Desktop uses port 3389 (RDP). The Basics tab offers to open such ports to the whole internet so that you can connect easily.
Here is the danger: the internet is full of automatic programs that constantly try thousands of addresses and common ports, guessing passwords. A machine with an open administration port and a public address is found and attacked within minutes. This is not an exaggeration. It is the normal background noise of the internet.
No public inbound ports
Choose none, and connect through Azure Bastion or a private network connection.
Allow only your own address
After creation, edit the firewall rule so that only your own public address may reach port 22 or 3389.
Just-in-time access
With the right Defender for Cloud plan, ports stay closed and open for a short time only when you request access.
Open to everyone permanently
Convenient for a moment, dangerous for as long as it stays that way.
Leaving the shop’s back door open to the street with a note saying “please do not enter” will not stop thieves. Giving the key only to yourself, or letting people in through a guarded reception, will.
If your machine will host a website, ports 80 and 443 for web traffic must be reachable, but administration ports should still not be open to everyone.
11Step 6: Disks
The disk tab decides how fast, how durable and how costly your storage is.
Your VM uses managed disks, where Azure handles the storage accounts and replication for you. The OS disk is always present. You can add data disks for application files, which is a good habit because data then stays separate from the operating system.
| Disk type | Character | Typical use |
|---|---|---|
| Standard HDD | Lowest cost, slower | Backups, rarely used data |
| Standard SSD | Moderate cost, steady performance | Light web servers, development, test |
| Premium SSD | Fast, low delay, higher cost | Production workloads and databases |
| Premium SSD v2 and Ultra Disk | Very high performance, flexible tuning | Demanding databases and special needs, mostly for data disks |
Encryption
Disks are encrypted at rest by default with keys managed by Azure. You can add options such as customer-managed keys or encryption at host for stricter needs.
Delete with VM
Decide whether disks are deleted when the VM is deleted. For learning, enabling this avoids leaving orphaned disks that keep billing.
Disk size
You pay for the size you provision, not the amount you fill, so do not select a larger disk than you need.
The OS disk is the cupboard where the unit keeps its essential fittings. Data disks are extra storage rooms. Faster and sturdier rooms cost more rent.
12Step 7: Networking
The networking tab decides how your machine talks to others and to the internet.
A virtual network, or VNet, is your private network in Azure. It has an address range, written in a notation called CIDR, and is divided into subnets. The wizard can create a new VNet and subnet for you, which is fine for learning. In real projects, network design is planned carefully, because changing it later is hard.
Public IP address
Gives the VM an internet address. Modern public IPs use the Standard type with a fixed address. If you do not need direct internet access, choose none and use Bastion.
NIC network security group
Select Basic to get simple rules for the ports you chose, or None if the subnet already has a group. Advanced lets you use your own.
Accelerated networking
Improves network speed and reduces delay for supported sizes. Usually enabled by default where possible.
Load balancing
Optional placement behind a load balancer or application gateway. Not needed for a single first VM.
Outbound internet access
Azure has been moving away from implicit default outbound access for new networks, so a VM may need an explicit way to reach the internet, such as a NAT gateway or public IP. Check current guidance if updates fail to download.
The VNet is the private corridor system inside the mall. Subnets are the separate wings. The public IP is the street address on the outside of the shop, and the security group is the guard list at the door.
13Step 8: Management, Monitoring and Advanced Tabs
These tabs hold small switches that save money and prevent trouble.
Auto-shutdown
Schedule the VM to stop each evening and receive a warning message. For learning and test machines, this is the best money-saving switch in the whole wizard.
Backup
Enable Azure Backup to take regular recovery points. Useful for any machine holding data you care about.
Patching
Choose automatic guest operating system patching or use Azure Update Manager, so security updates are applied without remembering to do it.
Managed identity
Gives the VM its own identity in Azure, so programs on it can access other Azure services without stored passwords.
Defender for Cloud
Basic security recommendations are free; deeper protection plans are paid. Consider them for production machines.
Boot diagnostics
Captures screenshots and logs from startup, which helps when a machine does not start correctly. Keep it enabled.
Extensions and custom data
On the Advanced tab you can attach small add-ons or startup instructions. Skip these for your first machine.
Auto-shutdown is a timer that switches off the shop’s lights at closing time. Backup is a photograph of the shelves taken regularly. Patching is the repair crew that fixes known faults while you sleep.
14Step 9: Tags, Review and Create
Last, label the machine, check the summary and deploy.
Tags are name-and-value labels, such as “owner: your name”, “purpose: learning” and “delete-after: a date”. They help you find resources, split cost by project and clean up forgotten items. The Review and create tab runs a validation check, shows a summary and displays the estimated hourly price. Read the summary before clicking Create. If you chose to generate an SSH key, a window offers to download the private key file at this moment. Save it before continuing.
Add useful tags
At least owner, purpose and expiry date.
Wait for validation to pass
Fix any messages in red before continuing.
Check price and settings
Confirm size, disk type, public IP, open ports and auto-shutdown.
Create and save the key
Press Create, download the key file if prompted, and watch the deployment progress.
Before signing the rental agreement, you read the last page, check the monthly price and confirm the key handover. After signing, the unit is yours.
The Review tab lets you download the settings as a template. This is a good way to repeat the same machine later through automation, once you are comfortable.
15Connecting to Your VM
There are several ways to enter your new machine, and some are safer than others.
flowchart LR
ME["You at your computer"] -->|"SSH or RDP over the internet"| PIP["Public IP and security group"]
PIP --> VM1["VM"]
ME -->|"Browser over HTTPS"| BAS["Azure Bastion"]
BAS -->|"Private network"| VM2["VM with no public IP"]
ME -->|"VPN or private link"| VNET["Private network"]
VNET --> VM3["VM"]
SSH (Linux)
A secure text-based connection from your computer’s terminal, using your private key.
Remote Desktop (Windows)
A graphical connection using the Remote Desktop client, your username and password.
Azure Bastion
A managed service that lets you connect through your web browser over a secure channel, with no public IP or open administration port on the VM. It is a paid service, so consider its cost.
Serial console and Run command
Emergency tools in the portal to help when normal network access fails or to run simple scripts without connecting.
VPN or private connection
For company machines, reach the VM through a private link to your office network.
On the VM page, the Connect button shows options and instructions for your machine. If you cannot connect, the most common reasons are: the private key file permissions are too open, the security group does not allow your address, you used the wrong username, or the machine is not running.
You can enter the shop through the street door with your key, through a staffed reception that escorts you in, or through the private staff corridor. The less public the route, the safer it is.
16Your First Hour on the Machine
Once you are in, a few habits make the machine safer and more useful.
Apply updates
Install the latest operating system updates before anything else. New images may be a few weeks old.
Create a normal user
For daily work, avoid using the all-powerful administrator account. Use ordinary accounts and elevate only when needed.
Install only what you need
Every extra program is another thing to patch and secure.
Turn on the host firewall
The operating system has its own firewall, which works in addition to the Azure security group.
Check the time and region settings
Make sure time zone and language fit your needs, because logs and schedules depend on them.
Take a first backup or snapshot
Once configured, create a recovery point so you can return to a clean state if an experiment breaks something.
When you move into a new unit, you first clean it, change the locks, arrange the essential furniture and take photos of the clean state, before you start doing business.
17Understanding Stop, Deallocate and Delete
Three different actions look similar but have very different effects on your bill.
stateDiagram-v2
[*] --> Running: Create
Running --> StoppedAllocated: Shut down from inside the OS
Running --> Deallocated: Stop in the portal
StoppedAllocated --> Deallocated: Deallocate
Deallocated --> Running: Start
StoppedAllocated --> Running: Start
Deallocated --> [*]: Delete
Running --> [*]: Delete
| State | Compute charge | Disk and IP charges | Notes |
|---|---|---|---|
| Running | Yes | Yes | Normal operation |
| Stopped (still allocated) | Yes | Yes | Shutting down only from inside the operating system keeps the hardware reserved, so the compute meter continues |
| Stopped (deallocated) | No | Yes | Stopping through the portal or Azure tools releases the hardware. Disks and static public IPs still bill |
| Deleted | No | No, if disks and IPs are deleted too | Check that attached disks, IP addresses and network interfaces were also removed |
Deallocation has side effects. The VM may receive a different private or public address when started again unless the address is static, and the temporary disk contents are lost. Always keep important data on persistent disks.
Locking the shop door and going home does not stop the rent. Giving the unit back to the mall owner does. Even then, if you leave furniture in a storage room, that room still charges.
Shutting down from inside the operating system and believing billing has stopped. Check the status in the portal and make sure it says Stopped (deallocated).
18Cost Basics for a First VM
A VM bill is made of a few predictable parts.
Compute
Charged for each hour or second the VM runs in the allocated state, depending on size, region and operating system.
Disks
Charged for provisioned size and type, whether the VM is running or not.
Public IP address
Standard public IPs have a small hourly charge.
Data leaving Azure
Outbound data beyond a free monthly allowance is charged.
Extras
Backups, Bastion, monitoring data, Defender plans and marketplace software are billed on top.
Estimate first
Use the Azure pricing calculator with your chosen size, disk and hours.
Use auto-shutdown and small sizes
Run only when needed and pick the smallest suitable size.
Use savings options for real workloads
For production, look at reservations, savings plans, Spot capacity for interruptible tasks, and Hybrid Benefit for eligible licenses.
Monitor
Check Cost Management weekly while you are learning.
The monthly shop cost has the rent, the storage room, the street signboard and the electricity. Turning off the lights helps, but only returning the key ends the rent.
19Keeping the VM Healthy: Monitoring
A running machine needs a basic watch on its health.
The VM overview page shows simple charts for processor use, network traffic and disk activity, collected without extra setup. These are platform metrics. For memory use and inside-the-machine details, you can add Azure Monitor with an agent, which collects deeper metrics and logs into a workspace.
Processor percentage
Constantly near the top means the size is too small. Constantly near the bottom means it may be too large.
Memory and disk space
Running out of either causes slowness or failures. Needs the monitoring agent for memory details.
Availability
Resource health shows whether the platform or your machine has a problem.
Alerts
Create alerts for high processor use, low disk space and unexpected stops, sent to an email or team chat.
A shopkeeper looks at the electricity meter, the footfall counter and the temperature gauge each morning. They do not need all of them every second, but they notice when something changes.
20Changing the VM Later: Resize, Add Disks, Move
Cloud machines can be adjusted, which is why you can start small.
Resize
If the machine is too small, change to a bigger size, or to a smaller one if it is oversized. This usually restarts the VM, so schedule it at a quiet time. The list of available sizes depends on the hardware cluster your VM runs on and quota.
Add or expand disks
Attach a new data disk, or increase the size of an existing disk. After increasing size, you must also extend the partition inside the operating system.
Create images and copies
After configuring a machine well, capture it as an image, then create more machines from it, so each starts identical.
Move to another resource group or subscription
Many resources can be moved between groups or subscriptions, with some restrictions. Moving to another region is a larger operation that needs planning.
If the shop becomes too crowded, you can move to a bigger unit in the same mall, add a storage room, or copy your tidy shop layout to open a second branch.
21Cleaning Up Safely
The last step of every experiment is to remove it so that billing ends.
Because everything for your experiment lives in one resource group, cleanup is simple: delete the resource group, which deletes the VM, disks, network interface, public IP, security group and network together. The portal asks you to type the group name to confirm, which prevents accidents. Before doing this, double-check that the group contains nothing you need, and that you saved any important files elsewhere.
Save what matters
Copy any files, notes or configuration you want to keep to another location.
Open the resource group
Review the list of resources inside it and confirm they all belong to the experiment.
Delete the group
Type its name to confirm. Wait until the deletion completes.
Check the bill next day
Confirm in Cost Management that costs have stopped, and look for stray items elsewhere.
When you leave the rented unit, you take your belongings, return all keys, cancel the electricity and water, and ask for a final statement. Only then is the lease truly over.
Deleting only the VM and forgetting the disks, the public IP and the Bastion host. These keep charging quietly for months. Deleting the whole resource group avoids this problem.
22Best Practices and Anti-Patterns
Habits to start with from your very first machine.
One resource group per experiment
Name and tag it clearly, and delete it when finished.
Use keys or identity, not weak passwords
Prefer SSH keys or Entra ID sign-in, with multifactor authentication where possible.
Do not expose administration ports
Use Bastion, just-in-time access or a restricted source address.
Patch and back up
Turn on automatic updates and backups for anything you want to keep.
Start small and measure
Resize based on real monitoring data rather than guesses.
Automate repeatable builds
Once you are comfortable, describe machines as templates or infrastructure code instead of clicking each time.
Problem
A test VM is created with a simple password and remote access open to the entire internet, then left running for months.
Why It’s Harmful
Automatic attacks find it within minutes, guess the password and use the machine for harm, such as hidden crypto mining or attacks on others, with your account paying the bill.
Correct Approach
Use keys, close public administration ports, connect through Bastion or a restricted address, and set auto-shutdown and an expiry date.
Problem
A single VM runs an important business application with no backup, no monitoring and manual configuration known only to one person.
Why It’s Harmful
If the disk fails, the person leaves or someone makes a mistake, the application and its data cannot be recovered or rebuilt.
Correct Approach
Enable backups, add monitoring and alerts, document or automate the setup, and consider redundancy for important workloads.
Problem
Every experiment is created in the same shared resource group, with no tags and no expiry.
Why It’s Harmful
Nobody knows what is safe to delete, so old machines, disks and addresses accumulate and keep billing.
Correct Approach
Use separate groups, tag owner and expiry, set budgets and review resources monthly.
23Real-World Examples
Seeing how people use a first VM makes the ideas easier to remember.
A student learning Linux
A student creates a small Linux VM with an SSH key, uses it for a month of practice, sets auto-shutdown at night and deletes the resource group after exams. The cost stays within free credits.
A developer testing software on Windows
A developer needs a Windows machine for one week. They create one with a Dev/Test image, connect through Bastion, take a snapshot of the clean state and delete everything at the end.
A small business hosting a simple website
A small business runs a website on a modest Linux VM. Ports 80 and 443 are open, administration is restricted to the owner’s address, automatic updates are enabled and nightly backups protect the data.
A team creating a lab for training
A trainer prepares a well-configured VM, captures it as an image, and creates identical copies for each student in separate resource groups. After the course, all groups are deleted in one clean step.
A company migrating an old application
A company moves an old internal application to a VM sized according to measured usage. They use managed disks, backups and monitoring, and later plan to move parts of it to managed services.
24Frequently Asked Questions
Usually a few minutes. Larger sizes, special images or capacity shortages in a region can take longer or fail, in which case you can choose another size or region.
Microsoft has generally offered a free account with credits and limited free monthly hours on certain small VM sizes for a period. Offers change, so read the current terms and stay within the listed sizes and limits.
Choose the one your software needs. Linux is often cheaper and lighter. Windows is needed for Windows-only software and includes a license charge unless you bring your own eligible license.
It is risky. Automatic attacks scan for these ports constantly. Prefer Bastion, just-in-time access or a rule that allows only your own address.
Either the VM was shut down from inside the operating system and is still allocated, or you are paying for disks, public IP addresses and other resources that remain. Deallocate in the portal and delete resources you no longer need.
Yes. Resizing usually restarts the machine. The sizes you can pick depend on the hardware where it runs and your quota, and sometimes you must deallocate first.
You can use Azure recovery features to reset access, such as resetting the SSH public key or using a serial console, depending on the setup. It is far easier to store the key safely in the first place.
Not always. VMs give maximum control but need maintenance. For simple web apps, databases or containers, managed services often save effort. Use VMs when you need that control or must run software that needs a full operating system.
25Summary and Key Takeaways
You have now followed the full life of a first Azure virtual machine. You learned what a VM is, what supporting resources come with it, and how a request travels through Azure Resource Manager. You walked through the creation wizard: basics, image, size, authentication, inbound ports, disks, networking, management and tags. You then saw how to connect safely, what to do during the first hour, how stopping and deallocation differ, how costs arise, how to monitor and resize the machine, and how to clean everything up with a single resource group deletion.
The most useful habit is simple: begin small, secure the doors, set auto-shutdown, tag everything and delete when finished. With that foundation, you can move on to more advanced topics such as availability zones, scale sets, load balancers, automation and managed services. A first VM is not just a server. It is your first practice in thinking clearly about cost, security and responsibility in the cloud.
Key Takeaways
- A VM is rented compute — you choose the operating system and size, Microsoft runs the hardware, and you manage everything inside the machine.
- It comes with a family of resources — disks, network interface, virtual network, public IP and security group are created alongside it and must be cleaned up too.
- Start small and right-size later — choose a modest general-purpose or burstable size, and use real monitoring data before growing.
- Secure the doors — use SSH keys or Entra ID, avoid open administration ports, and prefer Bastion, just-in-time access or a restricted source address.
- Know stopped from deallocated — only deallocation stops compute billing, while disks and public IPs keep charging until deleted.
- Turn on the safety switches — auto-shutdown, automatic patching, backups, boot diagnostics and alerts prevent common problems.
- Clean up with one resource group — tag resources with owner and expiry, delete the group when done, and verify in Cost Management that billing has stopped.