Introduction

In the previous articles of this series, we explored Azure fundamentals, Azure regions, availability zones, and resource groups. These concepts form the foundation of Microsoft Azure, but they also raise an important question:

What actually happens behind the scenes when you click "Create Virtual Machine" in the Azure Portal?

Does the Azure Portal directly create the virtual machine?

How does Azure CLI work?

What about PowerShell, Terraform, Bicep, or ARM Templates?

The answer is Azure Resource Manager (ARM).

Azure Resource Manager is the deployment and management service for Microsoft Azure. Every resource you create in Azure, whether it's a virtual machine, storage account, Azure SQL database, virtual network, or Kubernetes cluster, is provisioned through Azure Resource Manager.

Whether you're using the Azure Portal, Azure CLI, Azure PowerShell, REST APIs, ARM Templates, Bicep, or Terraform, every request ultimately passes through ARM before reaching the Azure service responsible for creating the resource.

Understanding ARM is one of the most important concepts in Azure Infrastructure because it sits at the heart of every Azure deployment. It provides a consistent management layer that handles authentication, authorization, policy enforcement, resource deployment, and lifecycle management across all Azure services.

In this article, we'll explore Azure Resource Manager in depth, understand its architecture, deployment process, and components, and learn why it is considered the "control center" of Microsoft Azure.

What is Azure Resource Manager?

Azure Resource Manager (ARM) is Microsoft's deployment and management layer for Azure.

It acts as the central management service that receives deployment requests, validates permissions, applies governance rules, and communicates with Azure Resource Providers to provision resources.

Instead of every Azure service exposing its own deployment interface, Microsoft created ARM as a unified management platform.

This means that regardless of how a resource is created, the process remains consistent.

For example, these commands all use ARM:

ARM provides a standardized way to deploy, update, and delete Azure resources.

Why Was Azure Resource Manager Introduced?

Before ARM, Azure used a deployment model called Azure Service Management (ASM), commonly referred to as the Classic Deployment Model.

Classic deployments had several limitations:

Managing large enterprise environments became increasingly difficult.

Microsoft introduced Azure Resource Manager to address these limitations by providing the following:

Today, almost every Azure service uses the ARM deployment model, and the Classic deployment model has been retired for most services.

Azure Management Hierarchy

To understand ARM, it's helpful to see where it fits within Azure's management hierarchy.

Designer (17)

Azure Resource Manager operates across this entire hierarchy, coordinating deployments and enforcing governance.

Azure Resource Manager Architecture

At a high level, Azure Resource Manager acts as the central orchestration engine.

Designer (20)

Regardless of which deployment tool you use, ARM processes every request before it reaches the target Azure service.

Azure Control Plane vs Data Plane

One of the most important concepts in Azure is understanding the difference between the control plane and the data plane.

Control Plane

The control plane is responsible for managing Azure resources.

Examples include:

All of these operations pass through Azure Resource Manager.

Data Plane

The data plane handles the actual interaction with the service after it has been created.

Examples include:

These operations communicate directly with the Azure service instead of ARM.

Control Plane vs Data Plane Comparison

Control PlaneData Plane
Managed by ARMManaged by Azure Service
Creates resourcesUses resources
Deletes resourcesReads/Writes data
Applies RBACService-specific permissions
Applies Azure PolicyService-level authorization
Deploys infrastructureAccesses workload

Understanding this distinction is critical when designing secure Azure environments.

How ARM Processes a Request

Let's walk through what happens when you create a virtual machine using the Azure Portal.

Step 1 – User Submits Request

The administrator clicks:

Create → Virtual Machine

The portal sends a request to ARM.

Step 2 – Authentication

ARM verifies the user's identity using Microsoft Entra ID.

If authentication fails, the request is rejected.

Step 3 – Authorization

ARM checks Azure Role-Based Access Control (RBAC).

Questions ARM asks include:

If authorization fails, the deployment stops.

Step 4 – Azure Policy Evaluation

ARM evaluates Azure policies assigned to the subscription, management group, or resource group.

Examples include:

If the deployment violates policy, ARM blocks it.

Step 5 – Resource Provider Selection

ARM identifies the correct Resource Provider.

For Virtual Machines:

Microsoft.Compute

For Storage Accounts:

Microsoft.Storage

For Virtual Networks:

Microsoft.Network

Step 6 – Resource Creation

The Resource Provider creates the requested resource.

Once provisioning completes successfully, ARM updates the deployment status.

Designer (21)

Resource Providers

Azure resource providers are services responsible for managing specific Azure resource types.

Every Azure service belongs to a Resource Provider namespace.

Examples include:

Resource ProviderAzure Service
Microsoft.ComputeVirtual Machines
Microsoft.StorageStorage Accounts
Microsoft.NetworkNetworking
Microsoft.SqlAzure SQL
Microsoft.WebApp Service
Microsoft.KeyVaultKey Vault
Microsoft.ContainerServiceAKS
Microsoft.InsightsAzure Monitor
Microsoft.RecoveryServicesAzure Backup

When a subscription is created, some providers are registered automatically. Others are registered when you first deploy a resource from that provider.

Resource IDs

Every Azure resource has a globally unique Resource ID.

Example:

/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

/resourceGroups/RG-Production

/providers/Microsoft.Compute

/virtualMachines/VM-Web01

Let's break it down:

SectionDescription
SubscriptionBilling and management boundary
Resource GroupLogical container
ProviderAzure service namespace
Resource TypeVirtual Machine
Resource NameVM-Web01

Resource IDs are commonly used in automation, scripting, and Azure APIs.

ARM Templates

Azure Resource Manager introduced Infrastructure as Code (IaC).

Instead of manually creating resources, infrastructure can be defined using JSON templates.

An ARM template describes the following:

A simplified ARM template might define:

Deploying the template creates the complete infrastructure consistently every time.

Bicep – The Modern Alternative

Although ARM templates remain fully supported, Microsoft now recommends Bicep for new deployments.

Benefits of Bicep include the following:

Bicep compiles into ARM templates before deployment, meaning ARM still performs the actual deployment.

Deployment Modes

ARM supports two deployment modes.

Incremental Deployment

This is the default mode.

ARM:

This is the recommended deployment mode for most scenarios.

Complete Deployment

Complete mode compares the template with the resource group.

Resources that are not included in the template may be deleted.

Because of this behavior, Complete mode should be used with caution, especially in production environments.

Dependency Management

Designer (22)

Many Azure resources depend on others.

ARM automatically deploys resources in the correct order based on their dependencies.

This eliminates manual sequencing during deployments.

ARM and Role-Based Access Control (RBAC)

Azure RBAC integrates directly with ARM.

Before creating or modifying a resource, ARM verifies:

For example:

A user with Reader permissions can view resources but cannot create or modify them.

A Contributor can create and manage resources but cannot assign permissions.

An Owner has full management access, including the ability to assign RBAC roles.

This centralized authorization model ensures consistent access control across Azure.

ARM and Azure Policy

Azure Policy works closely with ARM to enforce governance.

Whenever a deployment request is submitted, ARM evaluates applicable policies before provisioning resources.

Examples include:

If the deployment violates a policy, ARM blocks the request before any resources are created.

ARM and Resource Locks

ARM also enforces resource locks.

Two types are available:

CanNotDelete

Prevents accidental deletion while still allowing modifications.

ReadOnly

Prevents both modification and deletion.

Even users with Owner permissions cannot bypass these locks without first removing them.

Resource Locks provide an additional layer of protection for critical workloads.

Monitoring ARM Deployments

Azure Resource Manager records deployment activities.

Administrators can review:

Azure Activity Log also records management operations performed through ARM, providing an audit trail for governance and troubleshooting.

Benefits of Azure Resource Manager

Organizations use ARM because it provides:

These capabilities make ARM the foundation of Azure infrastructure management.

Common Mistakes

Many Azure beginners make these common mistakes:

Avoiding these mistakes leads to more secure, maintainable, and scalable Azure environments.

Enterprise Best Practices

Microsoft recommends the following practices when working with Azure Resource Manager:

Following these practices helps organizations maintain secure, repeatable, and well-governed Azure environments.

Summary

Azure Resource Manager (ARM) is the foundation of modern Azure infrastructure management. Every resource deployment—whether initiated through the Azure Portal, Azure CLI, PowerShell, REST API, ARM Templates, Bicep, or Terraform—flows through ARM before reaching the appropriate Azure service.

ARM does much more than create resources. It authenticates users with Microsoft Entra ID, verifies permissions through Azure RBAC, evaluates Azure policies, communicates with resource providers, manages dependencies, records deployment history, and enforces governance across the Azure platform.

By understanding how ARM works, administrators and architects gain deeper insight into the Azure deployment process and can design environments that are secure, scalable, automated, and compliant with organizational standards. As you continue your Azure journey, mastering ARM will also make it easier to adopt Infrastructure as Code, automate deployments, and build enterprise-ready cloud solutions.

Key Takeaways