Create one small private VM and take apart everything it needs

short · 30 min · Skills measured 2.2

Before you start — what this lab needs, and what it can cost

This lab runs in your own Azure subscription: an Azure free account or a pay-as-you-go subscription, with your own card on file, so every command acts on something real and billed to you. Charges are possible, so do the clean-up the same day you start; the Azure pricing calculator and each service's pricing page give current rates. It relies on the budget alert you set in lesson 1's lab, which emails you if this subscription starts to cost money. If you skipped that lab, do its first step before this one.

Work with the least privilege the lab allows. The Contributor role on the subscription is enough to create the resource group and the VM; nothing here grants access to anyone. You never need Global Administrator for it. On a brand-new account the first user is the subscription's Owner and the directory's Global Administrator, so if that is the only identity you have, use it carefully and only for the steps written here.

Work in Azure Cloud Shell, so nothing is installed and no credentials are handled: sign in to the Azure portal, select the Cloud Shell icon in the top toolbar and choose Bash. The first time it starts, choose No storage account required (an ephemeral session), so Cloud Shell itself creates nothing billable. An ephemeral session ends after about 20 minutes without input and forgets everything in it; if that happens, open a new session and re-run any line that sets a variable (a line such as NAME=$(az ...)) before you carry on. If you have more than one subscription, first select the one you use for these labs: az account set --subscription 00000000-0000-0000-0000-000000000000, with your own subscription ID in place of the zeros.

Every command uses the region eastus. You may choose a nearer region instead, but then use that same region everywhere this lab says eastus.

This is the one lab in this part of the course that runs a virtual machine. It uses the small Standard_B1s size, creates no public IP address and adds no inbound rule, and the VM is never signed in to, so no SSH or RDP access is opened to it at any point.

This lab ends with a clean-up. Do it the same day: anything left running in your subscription is billed to you.

Task

Create one small Linux virtual machine that nothing on the internet can reach, and then list every resource Azure made for it: the operating system disk, the network interface, the virtual network and the network security group. Read its size and its disk type side by side to see that they are different choices. Deallocate it to stop its compute charge, confirm the state, and delete it completely by deleting its resource group. Finally, match a set of requirements to the compute option lesson 7 recommends for each: a VM, a container, a function, App Service, a scale set, an availability set or Azure Virtual Desktop.

Steps

Create the lab's resource group:

az group create --name az900-lab07-rg --location eastus

Check that the small size is offered to your subscription in this region before you ask for it:

az vm list-skus --location eastus --resource-type virtualMachines --size Standard_B1s --query '[].{size:name, restrictions:length(restrictions)}' -o table

This can take half a minute. A row reading Standard_B1s with restrictions of 0 means you can use it. If the list is empty or the restriction count is above 0, run the same command with Standard_B2s and use that size in the next step instead. The size decides virtual CPUs and memory; you can change it later. 3. Create one small Linux VM. --public-ip-address "" gives it no public IP address, and --nsg-rule NONE stops the CLI adding its default inbound rule, so nothing outside Azure can reach it. --generate-ssh-keys writes a key pair into this Cloud Shell session only, and you never connect with it:

az vm create --resource-group az900-lab07-rg --name az900-lab07-vm --location eastus --image Ubuntu2204 --size Standard_B1s --admin-username azureuser --generate-ssh-keys --public-ip-address "" --nsg-rule NONE

It takes two or three minutes and prints a summary in which publicIpAddress is empty and privateIpAddress is an address inside the new virtual network. 4. List everything that one command made:

az resource list --resource-group az900-lab07-rg --query '[].{type:type, name:name}' -o table

Match each row to lesson 7's list of what a VM needs: virtualMachines is the VM itself; disks is its managed operating system disk; networkInterfaces connects it to a subnet; virtualNetworks gives it a private address; networkSecurityGroups holds its traffic rules, and here it holds none of your own. There is no publicIPAddresses row. This is why lesson 7 says a VM costs more than its compute: several of these resources exist, and some are billed, alongside it. 5. Read the VM's size and its disk type together:

az vm show --resource-group az900-lab07-rg --name az900-lab07-vm --query '{size:hardwareProfile.vmSize, osDiskType:storageProfile.osDisk.managedDisk.storageAccountType, image:storageProfile.imageReference.offer}' -o table

size (CPUs and memory) and osDiskType, such as Premium_LRS or StandardSSD_LRS (storage performance), are separate settings, which is the trap lesson 7 warns about. 6. Stop the compute charge. Deallocating releases the VM's hardware, so compute is no longer billed, but the disk still exists and is still billed until you delete it:

az vm deallocate --resource-group az900-lab07-rg --name az900-lab07-vm
az vm show --resource-group az900-lab07-rg --name az900-lab07-vm --show-details --query powerState -o tsv

The second command prints VM deallocated. 7. Match each requirement to one compute option from lesson 7, then check the Notes: (a) a legacy app that needs a specific older operating system and admin-installed software; (b) code that runs only when a file lands in storage and is billed per execution; (c) a short nightly job already packaged as a container, with no orchestrator; (d) a small team's Python web app with no servers to patch; (e) a web front end whose traffic doubles every weekday afternoon; (f) two VMs that must not reboot together during planned maintenance; (g) contractors who need one Windows application from their own laptops.

Verify

Read the VM's size, the number of public IP addresses in its group, and its power state.

az vm show --resource-group az900-lab07-rg --name az900-lab07-vm --query hardwareProfile.vmSize -o tsv

Expected output: Standard_B1s (or Standard_B2s if step 2 sent you to it).

az network public-ip list --resource-group az900-lab07-rg --query 'length(@)' -o tsv

Expected output: 0.

az vm show --resource-group az900-lab07-rg --name az900-lab07-vm --show-details --query powerState -o tsv

Expected output: VM deallocated.

Cost and clean-up

This lab can cost money: the VM's compute is charged while it runs, and its operating system disk is charged while it exists, even when the VM is deallocated. The amounts for the half hour the lab takes are small, but they are real, so delete the group as soon as you have read the Verify output. Deleting the VM alone with az vm delete would leave its disk, network interface and network security group behind, which is why the clean-up deletes the whole resource group.

Created by this lab: the resource group az900-lab07-rg; the VM az900-lab07-vm with its managed operating system disk, its network interface, the network security group az900-lab07-vmNSG and the virtual network az900-lab07-vmVNET; an SSH key pair in the Cloud Shell session's home folder.

Delete the resource group. That deletes az900-lab07-vm, its operating system disk, its network interface, az900-lab07-vmNSG and az900-lab07-vmVNET together, so nothing is left billing:

az group delete --name az900-lab07-rg --yes

This takes several minutes and returns when it has finished. 2. The SSH key pair lives only in this ephemeral Cloud Shell session and disappears when the session ends. To remove it now, run rm -f ~/.ssh/id_rsa ~/.ssh/id_rsa.pub.

Check it is gone

az group exists --name az900-lab07-rg

Expected output: false.

az disk list --query 'length([?contains(name, `"az900-lab07-vm"`)])' -o tsv

Expected output: 0, so no disk was left behind anywhere in the subscription.

Notes

Answers to step 7: (a) Azure virtual machines; (b) Azure Functions on the Consumption plan; (c) Azure Container Instances; (d) Azure App Service; (e) a Virtual Machine Scale Set with autoscale rules; (f) an availability set, whose update domains reboot one at a time; (g) Azure Virtual Desktop, publishing the application as a RemoteApp.

The CLI names the network security group and virtual network after the VM (az900-lab07-vmNSG, az900-lab07-vmVNET). If step 4 lists different names, the clean-up still removes them, because it deletes the whole group.

When you create the first virtual network in a region, Azure may also create a resource group named NetworkWatcherRG holding a Network Watcher for that region. It is a shared, subscription-wide monitoring setting rather than part of this lab, other networks you make later use it too, and simply having it enabled is not charged (its optional features, such as flow logs, are charged when you turn them on). This lab leaves it in place.

This is an independent study companion for the Microsoft Azure Fundamentals (AZ-900) exam and is not produced by or endorsed by Microsoft. Microsoft, Azure and Microsoft Entra are trademarks of the Microsoft group of companies.

This is an independent study companion for Microsoft Azure Fundamentals AZ-900 and is not produced by or endorsed by CompTIA.