Lesson: Creating and Configuring Virtual Machines in the Azure Portal

Introduction: The Foundation of Cloud Infrastructure

Virtual Machines (VMs) serve as the fundamental building blocks of Infrastructure as a Service (IaaS) in cloud computing. When you provision a Virtual Machine in Microsoft Azure, you are essentially renting a slice of a physical server located in an Azure data center. This capability allows organizations to migrate existing on-premises workloads to the cloud, test new applications in isolated environments, or scale infrastructure rapidly without the need to purchase, rack, and stack physical hardware.

Understanding how to properly create and configure these VMs is a critical skill for any cloud administrator or engineer. While the Azure Portal provides a user-friendly graphical interface to perform these tasks, the underlying configurations—such as networking, security, storage, and identity—have long-term implications for the cost, performance, and security of your environment. This lesson will guide you through the process of deploying VMs, configuring them for specific use cases, and establishing a baseline of best practices that will serve you well in production environments.

The Anatomy of an Azure Virtual Machine

Before diving into the portal, it is helpful to understand the components that make up an Azure VM. When you create a VM, you are not just creating a single object; you are orchestrating a collection of resources that work together to provide a functional compute environment.

• Virtual Machine Resource: The primary object that defines the size, operating system, and identity of the instance.
• Virtual Network (VNet) and Subnet: These provide the network connectivity for the VM, acting as the "cables" that connect your machine to the internet or your internal network.
• Network Interface Card (NIC): A virtualized adapter that allows the VM to communicate with the VNet.
• Public IP Address: An optional resource used if you need to access the VM from the public internet (though often discouraged for security reasons).
• Managed Disks: The virtual hard drives where the operating system and data reside.
• Network Security Group (NSG): A firewall that controls inbound and outbound traffic to the VM's network interface or subnet.

Callout: Virtual Machine vs. Physical Server Unlike a physical server, an Azure VM is abstracted from the hardware. You do not need to worry about power supply, cooling, or disk failure at the hardware level. However, this abstraction means you must pay close attention to the "logical" configuration. If you choose the wrong size or misconfigure the network, you cannot simply swap a cable or add a physical drive; you must manage the resource through the Azure Resource Manager (ARM) API or the portal.

Step-by-Step: Provisioning a VM in the Azure Portal

The Azure Portal is the most intuitive way to get started. Follow these steps to provision your first virtual machine.

1. Initiating the Deployment

Log into the Azure Portal. In the search bar at the top, type "Virtual Machines" and select it from the services list. Click the + Create button and choose Azure virtual machine.

2. The "Basics" Tab

This is where the most critical decisions are made.

• Project Details: Select your Subscription and Resource Group. If you don't have a resource group, create a new one. Think of a resource group as a logical container for your project's lifecycle.
• Instance Details: Provide a name for your VM and select the region. Choose your Availability Options—if you are running a production application, you should always select an Availability Zone or Availability Set to ensure uptime during data center maintenance.
• Image: Choose the operating system. You can select from pre-configured images like Windows Server, Ubuntu, or RHEL, or even use your own custom images.
• Size: Select a VM size based on your CPU and RAM requirements. Azure provides a list of sizes, from "B-series" (burstable for dev/test) to "D-series" (general purpose) and "E-series" (memory-optimized).

3. Authentication

You have two primary ways to authenticate: SSH public keys (recommended for Linux) or a password (for Windows/quick testing). If you choose SSH, the portal will help you generate a key pair. Keep your private key safe, as you cannot recover it if you lose it.

4. Networking, Management, and Disks

• Disks: Choose your OS disk type. Premium SSDs are recommended for production databases, while Standard HDD is usually sufficient for simple file servers or dev workloads.
• Networking: The portal will automatically create a VNet and subnet for you. You can also define an NSG here. For security, it is best to restrict inbound ports to only what is necessary (e.g., port 22 for SSH or 3389 for RDP).
• Management: Enable "Auto-shutdown" to save costs if this is a development machine. You can also enable "Backup" and "Azure Monitor" here, which are essential for long-term management.

Networking and Security Best Practices

One of the most common mistakes beginners make is opening up too many ports to the public internet. By default, if you allow RDP (3389) or SSH (22) from "Any" source, your VM will be subjected to constant brute-force attacks within minutes of deployment.

Implementing Secure Access

Instead of exposing management ports directly, consider these alternatives:

1. Azure Bastion: A fully managed service that provides secure RDP/SSH access to your VMs directly through the browser over SSL. It eliminates the need for public IP addresses on your VMs.
2. Just-In-Time (JIT) VM Access: Part of Microsoft Defender for Cloud, this feature allows you to open management ports only when you need them for a specific time window.
3. VPN/ExpressRoute: For enterprise environments, ensure that your VMs are placed in a private subnet that is only accessible via a site-to-site VPN or a dedicated ExpressRoute connection.

Note: A Public IP address is not required for a VM to be functional. If your VM only needs to communicate with other resources inside your VNet or with Azure services, do not assign a Public IP. This significantly reduces your attack surface.

Choosing the Right VM Size

Azure offers hundreds of VM sizes, which can be overwhelming. To choose effectively, categorize your workload:

Tip: Always start smaller than you think you need. Azure allows you to resize your VM with a simple restart. It is much easier to scale up than it is to justify the cost of an oversized, underutilized machine.

Automating Deployments: Beyond the Portal

While the portal is great for learning, it is not ideal for repeatable, consistent deployments. Manual configuration leads to "configuration drift," where two servers meant to be identical end up with subtle, hard-to-debug differences.

Using Azure CLI

The Azure Command Line Interface (CLI) is a powerful tool for scripting deployments. Here is a simple example of how to create a Linux VM using the CLI:

# Create a resource group
az group create --name MyResourceGroup --location eastus

# Create a VM
az vm create \
  --resource-group MyResourceGroup \
  --name MyLinuxVM \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

Explanation:

• az group create: Initializes the container for your resources.
• az vm create: Provisions the VM. By default, this command sets up the networking, public IP, and SSH keys automatically.
• --generate-ssh-keys: This flag automates the creation of an SSH key pair and saves it to your local machine, allowing you to log in immediately without managing password files.

Infrastructure as Code (IaC)

For production environments, you should use tools like Bicep or Terraform. These allow you to define your infrastructure in text files, which can be checked into version control (like Git). This provides an audit trail of who changed what, when, and why.

Managing Disks and Storage

Azure Managed Disks are the standard for VM storage. When you create a VM, the OS disk is created automatically. However, for applications that store data (like databases or web content), you should add Data Disks.

Best Practices for Disks:

• Separation of Concerns: Keep your OS on the OS disk and your application data on a separate data disk. If the OS becomes corrupted, you can often re-provision the OS disk while keeping your data disk intact.
• Disk Caching: For most data disks, Read-Only or Read/Write caching can improve performance. However, for high-write workloads like SQL Server, it is often recommended to disable caching to ensure data consistency.
• Encryption: Enable Azure Disk Encryption (ADE) or use Server-Side Encryption (SSE) with Customer-Managed Keys (CMK) to ensure your data is encrypted at rest, meeting compliance requirements.

Common Pitfalls and How to Avoid Them

Even experienced engineers run into issues when managing VMs. Here are the most frequent mistakes:

1. Ignoring Resource Tagging: Never deploy a resource without tags. Tags (e.g., Environment: Production, Owner: IT-Dept, CostCenter: 123) are essential for tracking costs and managing resource lifecycles. Without them, you will eventually find yourself with hundreds of VMs and no idea who owns them or what they are used for.
2. Over-provisioning: It is common to select a large VM size "just in case." Use Azure Advisor to monitor your CPU and memory usage. If your average CPU usage is below 10%, you are wasting money and should downsize the VM.
3. Static Public IPs: Using a public IP for a VM that doesn't need to be public-facing is a security risk. If you need a static IP for internal services, use a Private IP address within your VNet.
4. Forgetting to Configure Backups: Azure Backup is simple to enable. Always configure a backup policy for your production VMs. Relying on "snapshots" manually is error-prone and not a substitute for a robust recovery strategy.
5. Hardcoded Credentials: Never store passwords in scripts or configuration files. Use Azure Key Vault to store secrets and retrieve them at runtime.

Monitoring and Maintenance

Once a VM is up and running, your job isn't done. You must monitor its health and perform routine maintenance.

Azure Monitor and Log Analytics

Install the Azure Monitor agent on your VMs to collect performance data and logs. You can create alerts to notify you if CPU usage stays above 90% for more than 15 minutes or if the VM becomes unresponsive.

Patch Management

Azure Update Manager (formerly Automation Update Management) allows you to schedule updates for your Windows and Linux VMs. Instead of manually logging into each server to run apt-get upgrade or Windows Update, you can create a policy that automatically installs security patches during a maintenance window.

Callout: The "Pet vs. Cattle" Mindset In traditional data centers, servers were "pets"—you named them, nurtured them, and tried to keep them alive at all costs. In the cloud, servers should be "cattle." If a VM starts acting up, don't try to fix it; replace it. Use automation to spin up a new instance, ensure it is configured correctly via scripts, and decommission the old one. This ensures your environment remains clean and predictable.

Scaling Your Infrastructure

As your application grows, a single VM will eventually reach its limits. You have two ways to scale:

• Vertical Scaling: Increasing the size of the VM (e.g., moving from 2 cores to 4 cores). This requires a restart.
• Horizontal Scaling: Using Virtual Machine Scale Sets (VMSS). This allows you to run multiple instances of your VM and automatically add or remove instances based on demand.

VM Scale Sets are the preferred method for production web applications. They integrate with Azure Load Balancer to distribute traffic across your instances, ensuring that if one VM fails, your application remains available.

Comprehensive Key Takeaways

Creating and managing Virtual Machines in Azure is a core competency that requires balancing performance, cost, and security. By following these principles, you will build a professional-grade environment:

1. Security First: Always minimize the public attack surface. Use Azure Bastion instead of public IPs for management, and use Network Security Groups to restrict traffic to the absolute minimum required.
2. Resource Organization: Always use Resource Groups and Tags. This is not just for organization; it is critical for cost management, auditing, and clean-up.
3. Right-Sizing: Start with a smaller VM size and use monitoring data to scale up if necessary. Avoid the "bigger is better" trap, which leads to significant unnecessary expenditure.
4. Automation: Move away from manual portal configurations as soon as possible. Use Azure CLI, Bicep, or Terraform to ensure your deployments are repeatable and documented.
5. Lifecycle Management: Treat your VMs as temporary assets. Use tools like Azure Update Manager to handle patching automatically, and don't be afraid to replace a broken VM rather than repairing it.
6. Backup and Recovery: Never assume a VM will run forever. Always enable Azure Backup and have a tested recovery plan. A VM without a backup is a liability.
7. Cost Awareness: Use tools like Azure Cost Management to keep an eye on your spending. Set up budget alerts so you are notified before a surprise bill hits your inbox at the end of the month.

By mastering these concepts, you ensure that your Azure infrastructure is not just a collection of servers, but a resilient, efficient, and secure platform that supports the needs of your business or project. Remember that cloud infrastructure is dynamic; continue to review your configurations regularly to take advantage of new features and pricing optimizations that Microsoft frequently releases.