Creating Your First Azure VM: Step-by-Step with the CLI

Before you start

You need two things: the Azure CLI installed and authenticated. If you have not done this yet, see installing the Azure CLI. Then run:

# Authenticate with your Azure account
az login

# Confirm which subscription is active
az account show --output table

If you have multiple subscriptions, set the correct one before creating any resources:

az account set --subscription "My Subscription Name"

Step 1: Create a resource group

Every Azure resource must belong to a resource group. A resource group is a container that holds related resources — it makes management, billing, and cleanup straightforward. When you delete a resource group, all resources inside it are deleted together.

az group create \
  --name learn-vm-rg \
  --location eastus

Choose a region close to your users or your other Azure resources. Run az account list-locations —output table to see all available regions and their display names.

Step 2: Create the VM

A single az vm create command creates the VM and all required supporting resources: a virtual network, subnet, public IP address (optional), network interface, and network security group.

az vm create \
  --resource-group learn-vm-rg \
  --name my-first-vm \
  --image Ubuntu2204 \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

What each flag does:

• —image Ubuntu2204 — boots from Ubuntu 22.04 LTS. Run az vm image list —output table for other options.
• —size Standard_B2s — a burstable VM with 2 vCPUs and 4 GB RAM. Good for light workloads and learning. See VM sizes explained for the full family breakdown.
• —admin-username azureuser — the Linux user account created on the VM. Avoid root or admin.
• —generate-ssh-keys — creates an RSA key pair if one does not exist in ~/.ssh/ and registers the public key on the VM.
• —public-ip-sku Standard — attaches a Standard SKU public IP. Standard SKU is required for Availability Zone support and is recommended over Basic.

The command takes 1–3 minutes. When it completes, it returns JSON including the VM’s public IP address:

{
  "publicIpAddress": "20.x.x.x",
  "resourceGroup": "learn-vm-rg",
  "id": "/subscriptions/.../virtualMachines/my-first-vm"
}

Step 3: Connect to your VM

SSH to the VM using the public IP address from the previous step:

ssh azureuser@20.x.x.x

If you used —generate-ssh-keys, the CLI saved the private key to ~/.ssh/id_rsa and SSH will use it automatically. Once connected, you are inside a standard Ubuntu shell. Run a quick check to confirm you are on Azure infrastructure:

# Check the OS version
cat /etc/os-release

# Check the VM's hostname (matches the VM name in Azure)
hostname

# View attached disks
lsblk

You will see an OS disk (sda) and typically a temporary disk (sdb). The temporary disk is local to the physical host and is lost when the VM is deallocated — do not store data you want to keep there.

Step 4: Basic VM management commands

A few CLI commands you will use regularly:

# Stop and deallocate the VM (stops billing for compute)
az vm deallocate --resource-group learn-vm-rg --name my-first-vm

# Start a deallocated VM
az vm start --resource-group learn-vm-rg --name my-first-vm

# Restart a running VM
az vm restart --resource-group learn-vm-rg --name my-first-vm

# Show VM status
az vm show \
  --resource-group learn-vm-rg \
  --name my-first-vm \
  --show-details \
  --output table

# List all VMs in a resource group
az vm list --resource-group learn-vm-rg --output table

The distinction between stop and deallocate matters for billing. az vm stop shuts down the OS but keeps the hardware allocated — you continue paying for compute. az vm deallocate releases the hardware reservation. Always deallocate when you want to stop billing.

Opening a port on the VM

The NSG created by az vm create only allows SSH by default. If you install a web server on the VM and want to reach it from your browser, open port 80:

az vm open-port \
  --resource-group learn-vm-rg \
  --name my-first-vm \
  --port 80 \
  --priority 900

This adds a rule to the VM’s NSG allowing inbound TCP on port 80 from any source. For production workloads, restrict the source to specific IP ranges or place the VM behind an Azure Load Balancer rather than exposing it directly.

Cleaning up: delete everything

Deleting the VM alone leaves orphaned resources — the managed disk, public IP, network interface, and NSG still exist and some may still incur charges. The cleanest approach is to delete the whole resource group:

az group delete --name learn-vm-rg --yes --no-wait

The —yes flag skips the confirmation prompt. The —no-wait flag returns the terminal immediately while deletion happens in the background. All resources in the group are deleted within a few minutes.

What az vm create built behind the scenes

A single az vm create command created seven Azure resources:

• Virtual Machine — the compute resource itself
• OS Managed Disk — a Premium SSD with the Ubuntu image
• Network Interface (NIC) — connects the VM to the virtual network
• Virtual Network — a private network space (10.0.0.0/16 by default)
• Subnet — a subdivision of the VNet (10.0.0.0/24 by default)
• Public IP Address — the externally accessible IP
• Network Security Group — the firewall with the SSH allow rule

In production you typically pre-create the virtual network and subnet rather than letting the VM create them, so you can place multiple resources in the same network with consistent addressing. The —vnet-name and —subnet flags on az vm create let you specify an existing network instead of creating a new one.