Hello everyone! Today I want to share my experience deploying Azure Virtual Machines with ARM templates. This was my biggest challenge because one VM needs many resources working together.<\/p>
When I deployed my first VM, I thought “just create one resource”. But I was wrong! A VM needs:<\/p>
Think of it like building a house. You need the neighborhood (VNet), the street (Subnet), security gate (NSG), address (Public IP), front door (Network Interface), mailbox (Storage), and the house itself (VM).<\/p>
All these must be created in the correct order. Let me show you my code!<\/p>
Here is my full template:<\/p>
{\n \"$schema\": \"https:\/\/schema.management.azure.com\/schemas\/2019-04-01\/deploymentTemplate.json#\",\n \"contentVersion\": \"1.0.0.0\",\n \"parameters\": {},\n \"functions\": [],\n \"variables\": {},\n \"resources\": [\n {\n \"name\": \"appnetwork\",\n \"type\": \"Microsoft.Network\/virtualNetworks\",\n \"apiVersion\": \"2020-11-01\",\n \"location\": \"North Europe\",\n \"properties\": {\n \"addressSpace\": {\n \"addressPrefixes\": [\"10.0.0.0\/16\"]\n },\n \"subnets\": [\n {\n \"name\": \"SubnetA\",\n \"properties\": {\n \"addressPrefix\": \"10.0.0.0\/24\",\n \"networkSecurityGroup\": {\n \"id\": \"[resourceId('Microsoft.Network\/networkSecurityGroups', 'app-nsg')]\"\n }\n }\n },\n {\n \"name\": \"SubnetB\",\n \"properties\": {\n \"addressPrefix\": \"10.0.1.0\/24\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"app-ip\",\n \"type\": \"Microsoft.Network\/publicIPAddresses\",\n \"apiVersion\": \"2020-11-01\",\n \"location\": \"North Europe\",\n \"properties\": {\n \"publicIPAllocationMethod\": \"Dynamic\"\n }\n },\n {\n \"name\": \"app-interface\",\n \"type\": \"Microsoft.Network\/networkInterfaces\",\n \"apiVersion\": \"2020-11-01\",\n \"location\": \"North Europe\",\n \"properties\": {\n \"ipConfigurations\": [\n {\n \"name\": \"ipConfig1\",\n \"properties\": {\n \"privateIPAllocationMethod\": \"Dynamic\",\n \"publicIPAddress\": {\n \"id\": \"[resourceId('Microsoft.Network\/publicIPAddresses', 'app-ip')]\"\n },\n \"subnet\": {\n \"id\": \"[resourceId('Microsoft.Network\/virtualNetworks\/subnets', 'appnetwork', 'SubnetA')]\"\n }\n }\n }\n ]\n },\n \"dependsOn\": [\n \"[resourceId('Microsoft.Network\/publicIPAddresses', 'app-ip')]\",\n \"[resourceId('Microsoft.Network\/virtualNetworks', 'appnetwork')]\"\n ]\n },\n {\n \"name\": \"rezastore8677676\",\n \"type\": \"Microsoft.Storage\/storageAccounts\",\n \"apiVersion\": \"2021-04-01\",\n \"location\": \"[resourceGroup().location]\",\n \"sku\": {\n \"name\": \"Standard_LRS\"\n },\n \"kind\": \"StorageV2\"\n },\n {\n \"name\": \"app-nsg\",\n \"type\": \"Microsoft.Network\/networkSecurityGroups\",\n \"apiVersion\": \"2020-11-01\",\n \"location\": \"[resourceGroup().location]\",\n \"properties\": {\n \"securityRules\": [\n {\n \"name\": \"Allow-RDP\",\n \"properties\": {\n \"description\": \"Allow RDP\",\n \"protocol\": \"Tcp\",\n \"sourcePortRange\": \"*\",\n \"destinationPortRange\": \"3389\",\n \"sourceAddressPrefix\": \"*\",\n \"destinationAddressPrefix\": \"*\",\n \"access\": \"Allow\",\n \"priority\": 100,\n \"direction\": \"Inbound\"\n }\n }\n ]\n }\n },\n {\n \"name\": \"appvm\",\n \"type\": \"Microsoft.Compute\/virtualMachines\",\n \"apiVersion\": \"2021-03-01\",\n \"location\": \"[resourceGroup().location]\",\n \"dependsOn\": [\n \"[resourceId('Microsoft.Storage\/storageAccounts', toLower('rezastore8677676'))]\",\n \"[resourceId('Microsoft.Network\/networkInterfaces', 'app-interface')]\"\n ],\n \"properties\": {\n \"hardwareProfile\": {\n \"vmSize\": \"Standard_D2s_v3\"\n },\n \"osProfile\": {\n \"computerName\": \"appvm\",\n \"adminUsername\": \"demousr\",\n \"adminPassword\": \"Azure@123\"\n },\n \"storageProfile\": {\n \"imageReference\": {\n \"publisher\": \"MicrosoftWindowsServer\",\n \"offer\": \"WindowsServer\",\n \"sku\": \"2019-Datacenter\",\n \"version\": \"latest\"\n },\n \"osDisk\": {\n \"name\": \"windowsVM1OSDisk\",\n \"caching\": \"ReadWrite\",\n \"createOption\": \"FromImage\"\n },\n \"dataDisks\": [\n {\n \"name\":\"vm-data-disk\",\n \"diskSizeGB\":16,\n \"createOption\": \"Empty\",\n \"lun\":0\n }\n ]\n },\n \"networkProfile\": {\n \"networkInterfaces\": [\n {\n \"id\": \"[resourceId('Microsoft.Network\/networkInterfaces', 'app-interface')]\"\n }\n ]\n },\n \"diagnosticsProfile\": {\n \"bootDiagnostics\": {\n \"enabled\": true,\n \"storageUri\": \"[reference(resourceId('Microsoft.Storage\/storageAccounts\/', toLower('rezastore8677676'))).primaryEndpoints.blob]\"\n }\n }\n }\n }\n ],\n \"outputs\": {}\n}<\/code><\/pre>This is a big template! Let me explain the important parts.<\/p>
Understanding Virtual Network<\/h3>{\n \"name\": \"appnetwork\",\n \"type\": \"Microsoft.Network\/virtualNetworks\",\n \"properties\": {\n \"addressSpace\": {\n \"addressPrefixes\": [\"10.0.0.0\/16\"]\n },\n \"subnets\": [\n {\n \"name\": \"SubnetA\",\n \"properties\": {\n \"addressPrefix\": \"10.0.0.0\/24\"\n }\n }\n ]\n }\n}<\/code><\/pre>Virtual Network (VNet) is like your private network in Azure.<\/p>
IP addressing explained:<\/p>
- 10.0.0.0\/16 = 65,536 IP addresses available (the whole network)<\/li>
- 10.0.0.0\/24 = 256 IP addresses available (one subnet)<\/li><\/ul>
Why \/16 and \/24?<\/p>
The number after \/ tells how many IP addresses you get:<\/p>
- \/16 = 65,536 addresses (10.0.0.0 to 10.0.255.255)<\/li>
- \/24 = 256 addresses (10.0.0.0 to 10.0.0.255)<\/li><\/ul>
Azure reserves 5 addresses:<\/p>
- 10.0.0.0 – Network address<\/li>
- 10.0.0.1 – Default gateway<\/li>
- 10.0.0.2 – DNS server<\/li>
- 10.0.0.3 – DNS server<\/li>
- 10.0.0.255 – Broadcast address<\/li><\/ul>
So SubnetA actually has 251 usable IP addresses (256 – 5).<\/p>
My VM will get IP like 10.0.0.4 or 10.0.0.5.<\/p>
Why two subnets?<\/p>
- SubnetA: For web servers<\/li>
- SubnetB: For database servers (future use)<\/li><\/ul>
This separates different types of servers for security.<\/p>
Understanding Public IP<\/h3>{\n \"name\": \"app-ip\",\n \"type\": \"Microsoft.Network\/publicIPAddresses\",\n \"properties\": {\n \"publicIPAllocationMethod\": \"Dynamic\"\n }\n}<\/code><\/pre>Public IP lets me connect to the VM from the internet.<\/p>
Dynamic vs Static:<\/p>
- Dynamic: IP changes when VM stops\/starts – FREE<\/li>
- Static: IP never changes – costs $3\/month<\/li><\/ul>
I use Dynamic for learning to save money. For production, use Static.<\/p>
Understanding Network Interface<\/h3>{\n \"name\": \"app-interface\",\n \"type\": \"Microsoft.Network\/networkInterfaces\",\n \"properties\": {\n \"ipConfigurations\": [\n {\n \"name\": \"ipConfig1\",\n \"properties\": {\n \"privateIPAllocationMethod\": \"Dynamic\",\n \"publicIPAddress\": {\n \"id\": \"[resourceId('Microsoft.Network\/publicIPAddresses', 'app-ip')]\"\n },\n \"subnet\": {\n \"id\": \"[resourceId('Microsoft.Network\/virtualNetworks\/subnets', 'appnetwork', 'SubnetA')]\"\n }\n }\n }\n ]\n },\n \"dependsOn\": [\n \"[resourceId('Microsoft.Network\/publicIPAddresses', 'app-ip')]\",\n \"[resourceId('Microsoft.Network\/virtualNetworks', 'appnetwork')]\"\n ]\n}<\/code><\/pre>Network Interface is like a network card. It connects VM to the network.<\/p>
Important parts:<\/p>
- privateIPAllocationMethod: Dynamic – Azure gives IP automatically<\/li>
- publicIPAddress – Links to the public IP I created<\/li>
- subnet – Connects to SubnetA<\/li><\/ul>
dependsOn is critical!<\/p>
The Network Interface needs two things first:<\/p>
- Public IP must exist<\/li>
- Virtual Network must exist<\/li><\/ol>
Without dependsOn, deployment fails!<\/p>
Understanding Storage Account<\/h3>{\n \"name\": \"rezastore8677676\",\n \"type\": \"Microsoft.Storage\/storageAccounts\",\n \"sku\": {\n \"name\": \"Standard_LRS\"\n },\n \"kind\": \"StorageV2\"\n}<\/code><\/pre>Why does VM need storage?<\/p>
For boot diagnostics – screenshots and logs when VM has problems.<\/p>
Standard_LRS means:<\/p>
- Standard = Uses hard drives (cheaper than SSD)<\/li>
- LRS = Locally Redundant Storage (3 copies in same datacenter)<\/li><\/ul>
This is the cheapest option, good for diagnostics.<\/p>
Note: VM’s actual disk is separate! This storage is only for troubleshooting.<\/p>
Understanding Network Security Group<\/h3>{\n \"name\": \"app-nsg\",\n \"type\": \"Microsoft.Network\/networkSecurityGroups\",\n \"properties\": {\n \"securityRules\": [\n {\n \"name\": \"Allow-RDP\",\n \"properties\": {\n \"protocol\": \"Tcp\",\n \"sourcePortRange\": \"*\",\n \"destinationPortRange\": \"3389\",\n \"sourceAddressPrefix\": \"*\",\n \"destinationAddressPrefix\": \"*\",\n \"access\": \"Allow\",\n \"priority\": 100,\n \"direction\": \"Inbound\"\n }\n }\n ]\n }\n}<\/code><\/pre>NSG is like a firewall. It controls what traffic can reach the VM.<\/p>
Understanding the rule:<\/p>
- protocol: Tcp – Rule for TCP traffic<\/li>
- sourcePortRange: “*” – Allow from any port (client side)<\/li>
- destinationPortRange: 3389 – Allow to port 3389 (RDP port)<\/li>
- sourceAddressPrefix: “*” – Allow from any IP address<\/li>
- access: Allow – Let the traffic through<\/li>
- priority: 100 – Lower number = checked first<\/li>
- direction: Inbound – Traffic coming TO the VM<\/li><\/ul>
Security Warning!<\/p>
sourceAddressPrefix: “*” means anyone can try to connect! This is only OK for home lab testing.<\/p>
For production, change to:<\/p>
\"sourceAddressPrefix\": \"1.2.3.4\" \/\/ Your IP only<\/code><\/pre>Understanding the Virtual Machine<\/h3>
Now the main part – the VM itself!<\/p>
Hardware Profile<\/h3>\"hardwareProfile\": {\n \"vmSize\": \"Standard_D2s_v3\"\n}<\/code><\/pre>Standard_D2s_v3 means:<\/p>
- 2 vCPUs<\/li>
- 8 GB RAM<\/li>
- Uses SSD (the ‘s’ means SSD)<\/li>
- Costs ~$70\/month if running 24\/7<\/li><\/ul>
For cheaper option, use Standard_B2s (~$30\/month).<\/p>
OS Profile<\/h3>\"osProfile\": {\n \"computerName\": \"appvm\",\n \"adminUsername\": \"demousr\",\n \"adminPassword\": \"Azure@123\"\n}<\/code><\/pre>computerName – VM hostname<\/p>
adminUsername and adminPassword – Login credentials<\/p>
My password is weak! Only for learning. Use strong passwords in production.<\/p>
Storage Profile – OS Disk<\/h3>\"storageProfile\": {\n \"imageReference\": {\n \"publisher\": \"MicrosoftWindowsServer\",\n \"offer\": \"WindowsServer\",\n \"sku\": \"2019-Datacenter\",\n \"version\": \"latest\"\n },\n \"osDisk\": {\n \"name\": \"windowsVM1OSDisk\",\n \"caching\": \"ReadWrite\",\n \"createOption\": \"FromImage\"\n }\n}<\/code><\/pre>imageReference tells Azure what OS to install:<\/p>
- publisher: MicrosoftWindowsServer<\/li>
- offer: WindowsServer<\/li>
- sku: 2019-Datacenter<\/li>
- version: latest<\/li><\/ul>
osDisk:<\/p>
- caching: ReadWrite – Cache reads and writes for better performance<\/li>
- createOption: FromImage – Create new disk from the Windows image<\/li><\/ul>
Azure automatically creates 127 GB disk for Windows Server.<\/p>
Storage Profile – Data Disk<\/h3>\"dataDisks\": [\n {\n \"name\":\"vm-data-disk\",\n \"diskSizeGB\":16,\n \"createOption\": \"Empty\",\n \"lun\":0\n }\n]<\/code><\/pre>This creates an extra 16 GB disk for data.<\/p>
lun = Logical Unit Number (like drive letter in Windows)<\/p>
- lun:0 = First data disk<\/li>
- lun:1 = Second data disk (if you add more)<\/li><\/ul>
createOption: Empty means the disk is blank. After VM starts, I need to format it in Windows.<\/p>
Network Profile<\/h3>\"networkProfile\": {\n \"networkInterfaces\": [\n {\n \"id\": \"[resourceId('Microsoft.Network\/networkInterfaces', 'app-interface')]\"\n }\n ]\n}<\/code><\/pre>This connects the VM to the Network Interface we created.<\/p>
Boot Diagnostics<\/h3>\"diagnosticsProfile\": {\n \"bootDiagnostics\": {\n \"enabled\": true,\n \"storageUri\": \"[reference(resourceId('Microsoft.Storage\/storageAccounts\/', toLower('rezastore8677676'))).primaryEndpoints.blob]\"\n }\n}<\/code><\/pre>What is this complex line?<\/p>
\"[reference(resourceId('Microsoft.Storage\/storageAccounts\/', toLower('rezastore8677676'))).primaryEndpoints.blob]\"<\/code><\/pre>Let me break it down:<\/p>
- resourceId(‘Microsoft.Storage\/storageAccounts\/’, toLower(‘rezastore8677676’)) – Get the storage account<\/li>
- reference(…) – Get properties of the storage account<\/li>
- .primaryEndpoints.blob – Get the blob URL<\/li><\/ol>
Result: https:\/\/rezastore8677676.blob.core.windows.net\/<\/p>
This is where Azure saves VM screenshots and logs.<\/p>
How I Deployed This<\/h3># Create resource group\naz group create \\\n --name vm-test-grp \\\n --location \"North Europe\"\n\n# Deploy the template\naz deployment group create \\\n --resource-group vm-test-grp \\\n --template-file 03-AzureVirtualMachines.json<\/code><\/pre>Deployment took about 7 minutes.<\/p>
What Happens During Deployment<\/h3>
Azure creates resources in this order:<\/p>
- Network Security Group (no dependencies)<\/li>
- Storage Account (no dependencies)<\/li>
- Virtual Network (needs NSG)<\/li>
- Public IP (no dependencies)<\/li>
- Network Interface (needs VNet and Public IP)<\/li>
- Virtual Machine (needs Network Interface and Storage)<\/li><\/ol>
ARM is smart – it figures out the order automatically based on dependsOn!<\/p>
Testing My VM<\/h3>
After deployment:<\/p>
- Get public IP from Azure portal<\/li>
- Open Remote Desktop Connection<\/li>
- Enter IP address<\/li>
- Login: demousr \/ Azure@123<\/li>
- Connected!<\/li><\/ol>
Inside the VM:<\/p>
- C: drive = OS Disk (127 GB)<\/li>
- D: drive = Temp disk (comes with VM)<\/li>
- Data disk not visible yet<\/li><\/ul>
To use data disk, I opened Disk Management in Windows:<\/p>
- Initialize disk<\/li>
- Create partition<\/li>
- Format as NTFS<\/li>
- Assign drive letter E:<\/li><\/ol>
Now I have E: drive with 16 GB!<\/p>
My Mistakes and Fixes<\/h3>Mistake 1: Wrong subnet resourceId<\/h3>\"subnet\": {\n \"id\": \"[resourceId('Microsoft.Network\/subnets', 'SubnetA')]\"\n}<\/code><\/pre>Error: “Resource not found”<\/p>
Fix: Use parent\/child format:<\/p>
\"subnet\": {\n \"id\": \"[resourceId('Microsoft.Network\/virtualNetworks\/subnets', 'appnetwork', 'SubnetA')]\"\n}<\/code><\/pre>Mistake 2: Storage account name uppercase<\/h3>\"name\": \"RezaStore8677676\"<\/code><\/pre>Error: “Storage account name must be lowercase”<\/p>
Fix: Use lowercase only: rezastore8677676<\/p>
Mistake 3: Forgot VM dependency on NIC<\/h3>\"dependsOn\": [\n \"[resourceId('Microsoft.Storage\/storageAccounts', 'rezastore8677676')]\"\n]<\/code><\/pre>Error: “Network interface does not exist”<\/p>
Fix: Add NIC to dependsOn:<\/p>
\"dependsOn\": [\n \"[resourceId('Microsoft.Storage\/storageAccounts', 'rezastore8677676')]\",\n \"[resourceId('Microsoft.Network\/networkInterfaces', 'app-interface')]\"\n]<\/code><\/pre>Mistake 4: Forgot to format data disk<\/h3>
After deployment, I couldn’t see E: drive!<\/p>
Issue: Empty disks need formatting.<\/p>
Fix: Used Disk Management in Windows to initialize and format the disk.<\/p>","protected":false},"excerpt":{"rendered":"
Why VMs Are Complex Hello everyone! Today I want to share my experience deploying Azure Virtual Machines with ARM templates. This was…<\/p>\n","protected":false},"author":2,"featured_media":123,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_rezaops_part":"3","_rezaops_linkedin_url":"https:\/\/www.linkedin.com\/pulse\/azure-virtual-machines-complete-arm-template-guide-reza-chegini-ue4tc\/","footnotes":""},"categories":[50,10],"tags":[53,52,8,55,57],"series":[51],"class_list":["post-101","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure","category-devops","tag-arm-templates","tag-azure","tag-devops","tag-iac","tag-virtual-machines","series-azure-arm-templates"],"jetpack_featured_media_url":"https:\/\/rezachegini.com\/wp-content\/uploads\/2026\/10\/azure-virtual-machines-arm-guide-cover.png","_links":{"self":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/101","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=101"}],"version-history":[{"count":1,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/101\/revisions"}],"predecessor-version":[{"id":102,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/posts\/101\/revisions\/102"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=\/wp\/v2\/media\/123"}],"wp:attachment":[{"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=101"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=101"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=101"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/rezachegini.com\/index.php?rest_route=%2Fwp%2Fv2%2Fseries&post=101"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}