Compute · Lesson 11 of 24

Virtual machines, sizes, disks, moves

A rented server: what you choose when you create one, what to do when it needs to grow, and how to move it.

About 10 min · Interactive · 3 practice questions

Exam objective
Create a virtual machine · Configure encryption at host · Move a VM to another resource group, subscription or region · Manage VM sizes · Manage VM disksDeploy and manage Azure compute resources · 20–25% of the exam · typical question: "Resize fails, what first?", disk type constraints, move tool for region vs resource group, encryption at host prerequisites
In one sentence. A virtual machine is a rented Windows or Linux server made of five separate objects (VM, OS disk, data disks, NIC, public IP), billed per second while running and for its disks always. A virtual machine is a Windows or Linux server running on Microsoft's hardware. You pick its size (CPU and RAM), its disks, and which network it plugs into. You pay per second while it runs and for the disks always.
What "a VM" really is: five objectsVirtual machinesize D4s_v5OS diskmanaged, 128 GiBData diskoptional, 32 TiB maxNICprivate IP in a subnetPublic IPoptionalNSGoptional firewall
Deleting the VM leaves the disks and NIC behind unless you tick "delete with VM". Each part is billed on its own.

You, the admin: build a web server

  1. Virtual machines › + Create › Azure virtual machine.
  2. Basics: resource group, name, region, Availability options (none / set / zone; this is your only chance to pick a set), image (Windows Server 2022 or Ubuntu), size (click "See all sizes"), admin username and password or SSH key, inbound ports (leave none open; use Bastion).
  3. Disks: OS disk type (Premium SSD for production), add data disks.
  4. Networking: VNet and subnet, public IP (choose None for internal servers), NIC NSG.
  5. Management: boot diagnostics on, auto-shutdown for dev VMs, enable Azure Backup if you have a vault.
  6. Review + create. Two to three minutes later: Connect › Bastion.

Script: az vm create -g RG1 -n web1 --image Ubuntu2204 --size Standard_D2s_v5 --vnet-name VNet1 --subnet Web --public-ip-address "" --admin-username azureuser --generate-ssh-keys

How a VM comes to exist

  1. BasicsName, region, availability option (set / zone, decided now), image, size, admin credentials.
  2. DisksOS disk type; add data disks.
  3. NetworkingVNet, subnet, public IP (None for internal servers), NIC NSG.
  4. Management and createBoot diagnostics, backup, auto-shutdown; Review + create; connect via Bastion.

Sizes

LetterBuilt for
BCheap and bursty (saves CPU credits when idle)
DGeneral purpose, the default choice
ELots of memory
FFast CPU
LFast local storage
MEnormous memory (SAP HANA)
NGPU

D4s_v5: D family, 4 vCPUs, s = can use Premium SSD, v5 = hardware generation. To resize: VM › Size, pick, Resize. The VM reboots. If the new size is greyed out or the resize fails with "not available", Stop (deallocate) the VM first; Azure may then place it on hardware that has that size. A deallocated VM costs nothing for compute, but its disks still bill.

Disks

TypeUseRules
Standard HDDBackups, devNo SLA for a single VM
Standard SSDLight web servers—
Premium SSDProductionVM size must have the "s"; gives the 99.9% single-VM SLA
Premium SSD v2Dial IOPS and throughput separatelyData disk only
Ultra DiskHighest performanceData disk only, only in availability zones
  • Always managed disks (Azure handles the storage account). OS disk up to 4 TiB, data disks up to 32 TiB. How many data disks depends on VM size. You can grow a disk; you cannot shrink it.
  • Snapshot (Disk › Create snapshot): a copy of one disk at that moment, used to make a new disk. Image: a cleaned, generalised VM (run sysprep /generalize on Windows, waagent -deprovision+user on Linux, then VM › Capture) stored in an Azure Compute Gallery so you can stamp out identical VMs.
  • Encryption: every managed disk is already encrypted at rest. Two extras: Azure Disk Encryption runs BitLocker or dm-crypt inside the guest with a key in Key Vault; Encryption at host encrypts on the physical server so even the temp disk and cache are covered. For encryption at host you first register the feature on the subscription (az feature register --namespace Microsoft.Compute --name EncryptionAtHost), the VM must be deallocated, and it cannot be combined with Azure Disk Encryption on the same VM.

Moving a VM

ToHow
Another resource group or subscriptionVM › Move. Select the VM, its disks, NIC, public IP together; validation lists anything that cannot go.
Another regionIt cannot be relocated. Copy it with Azure Resource Mover or Site Recovery, then delete the original.
Another availability set or zoneNot possible in place; recreate from the disks.

Also on the exam: Custom Script Extension and cloud-init run a script after build; Run Command executes a script from the portal without logging in; boot diagnostics show a screenshot and serial log when a VM will not start; the VM agent must be present for any extension.

Key points

  • A VM is five objects: VM, OS disk, data disks, NIC, optional public IP and NSG. Deleting the VM leaves the rest unless you tick delete-with-VM.
  • Size name decoded: D4s_v5 = family D, 4 vCPU, s = Premium SSD capable, v5 generation. Deallocate first if a resize is refused.
  • Disks grow, never shrink. Ultra Disk is data-only and zones-only. Premium SSD gives the 99.9% single-VM SLA.
  • Move between groups or subscriptions with Move; between regions only by copying (Resource Mover or Site Recovery).
  • Encryption at host needs the subscription feature registered and the VM deallocated; not with Azure Disk Encryption.

Formal terms: Deallocate, managed disk, premium-capable size, Azure Compute Gallery, generalised image, Azure Disk Encryption (ADE), encryption at host, Azure Resource Mover.

Check your understanding

3 exam-style questions in the formats AZ-104 uses. Each is marked when you check it, with the reasoning.

0 of 3 checked

All scenarios and questions are original. None are taken from the exam, Microsoft's practice assessment or any question bank. PrepToExcel is not affiliated with Microsoft.