Ravindran ManiNotes

Azure / Guide 7

Virtual machines

Sizing, disks, availability, patching, monitoring agents and saving money on VMs.

Virtual machines are usually the biggest line on an Azure bill and the biggest source of operational work. This guide covers sizing, disks, availability, patching, monitoring and the day-to-day tasks that keep a VM estate healthy and lean.

Know what you have

Start with an inventory. Get-AzVMInventory.ps1 lists every VM in every subscription with its size, power state, OS, disks, private IPs, zone, Azure Hybrid Benefit setting and tags:

.\Get-AzVMInventory.ps1

Look for VMs that are stopped but not deallocated (still billed for compute), VMs without an Owner tag, and old or oversized VM sizes.

Size it right

  • Use Azure Advisor's right-sizing recommendations as a starting point. They're based on actual CPU and memory use.
  • Prefer current VM generations (for example v5 and later). Newer generations usually give more performance for the same price or less.
  • B-series (burstable) VMs suit servers that are mostly idle with occasional spikes: jump boxes, small utility servers, test machines.
  • Resize in a maintenance window: changing size restarts the VM, and some sizes need the VM deallocated first.

Disks

Type Use for
Standard HDD Backups, rarely used data
Standard SSD Light workloads, dev and test, web servers
Premium SSD Production servers and databases
Premium SSD v2 / Ultra Disk High-performance databases where you tune IOPS and throughput separately

Tips:

  • Delete disks and NICs with the VM. When creating a VM, set the OS disk, data disks and network interface to delete with VM. Otherwise they're left behind, still billed, when the VM is deleted. Find-AzOrphanedResources.ps1 finds the ones already left behind.
  • Don't keep data on the temporary disk (usually D: on Windows). It's wiped on redeploy, resize and some host maintenance.

Availability

Setup Protects against Microsoft SLA (VM connectivity)
Single VM with Premium SSD or Ultra disks Nothing beyond the host 99.9%
Two or more VMs in an availability set Host and rack failures in one datacenter 99.95%
Two or more VMs across availability zones Loss of a whole datacenter in the region 99.99%

A single VM isn't highly available, whatever the SLA says. For anything that matters, run at least two instances across zones behind a load balancer, and protect data with backups (see the backup guide).

Patching with Azure Update Manager

Azure Update Manager is the current way to patch Windows and Linux VMs in Azure (and Arc-enabled servers on-premises). It replaced Automation Update Management, which was retired in 2024.

  1. Turn on periodic assessment so you always know which updates are missing.
  2. Create maintenance configurations with schedules, for example "Test VMs Tuesday 22:00" and "Production VMs Saturday 02:00".
  3. Assign VMs to them by subscription, resource group or tag (for example PatchGroup=Prod-Sat).
  4. Patch test first, then production a few days later.

Monitoring agents

Use the Azure Monitor Agent with data collection rules to send performance data and event logs to Log Analytics. The older Log Analytics agent (MMA/OMS) was retired in 2024; migrate any VMs still using it. VM insights gives ready-made performance charts and a map of connections. The monitoring guide covers queries and alerts.

Save money on VMs

  • Deallocate, don't just shut down. Shutting down from inside Windows leaves the VM "Stopped" but still allocated and billed. Stopping from the portal or with Stop-AzVM deallocates it.
  • Schedule non-production VMs. Tag dev and test VMs and let Invoke-AzVMPowerSchedule.ps1 stop them in the evening and start them in the morning, from Azure Automation with a managed identity. Running 12 hours on weekdays instead of 24/7 cuts their compute cost by roughly two-thirds.
  • Use Azure Hybrid Benefit if you have Windows Server or SQL Server licenses with Software Assurance:

powershell $vm = Get-AzVM -ResourceGroupName rg-notes-test -Name vm-notes-test-01 $vm.LicenseType = 'Windows_Server' Update-AzVM -ResourceGroupName rg-notes-test -VM $vm

  • Commit for steady workloads with reservations or a savings plan (see the cost guide).

Troubleshooting without RDP or SSH

When you can't sign in to a VM:

  • Boot diagnostics shows a screenshot of the console and the serial log.
  • Serial console gives a text console even when networking is broken.
  • Run Command runs a script inside the VM through the Azure agent:

powershell Invoke-AzVMRunCommand -ResourceGroupName rg-notes-test -VMName vm-notes-test-01 ` -CommandId 'RunPowerShellScript' -ScriptString 'Get-Service W3SVC; Get-NetFirewallProfile | Select Name, Enabled'

  • Redeploy moves the VM to a new host, which fixes some host-level problems (the temporary disk is wiped).