Microsoft Azure — Azure Resource Manager (ARM)

Azure is Microsoft's cloud computing platform offering over 200 services. This article covers azure resource manager (arm) with production-ready configurations, best practices, and hands-on examples.

What Is Azure Resource Manager?

Azure Resource Manager (ARM) is the deployment and management service for Azure. It provides a consistent management layer that enables you to create, update, and delete resources in your Azure subscription. ARM handles requests through Azure APIs, applies role-based access control (RBAC), tags, and policies, and ensures idempotent deployments. Every resource group in Azure is an ARM construct. Understanding ARM is non-negotiable for any DevOps engineer working with Azure — it's the foundation for Infrastructure as Code (IaC) on the platform.

az provider list --query "[?namespace=='Microsoft.Resources'].{Namespace:namespace, RegistrationState:registrationState}" -o table

ARM Templates: Declarative Infrastructure

ARM templates are JSON files that define the infrastructure and configuration for your Azure solution. They are declarative — you specify what you want, not how to achieve it. A template consists of parameters, variables, resources, and outputs. Parameters allow customization per environment (dev, staging, prod). Variables simplify expressions. Resources are the actual Azure components (VMs, databases, networks). Outputs return values like connection strings. ARM templates can be deployed via Azure Portal, CLI, PowerShell, or CI/CD pipelines. They support conditional deployment, loops, and dependencies.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageName": {
      "type": "string",
      "defaultValue": "mystorageaccount"
    },
    "location": {
      "type": "string",
      "defaultValue": "[resourceGroup().location]"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "[parameters('storageName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2"
    }
  ]
}

Parameters and Variables: Making Templates Reusable

Parameters make ARM templates reusable across environments. Define parameters for values that change per deployment (e.g., VM size, admin username). Use allowed values to restrict input. Variables are for values that are computed or reused within the template (e.g., concatenated names). Use functions like concat(), uniqueString(), and resourceGroup().location. Parameter files (JSON) store environment-specific values. Never hardcode secrets — use Azure Key Vault references in parameters.

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageName": {
      "value": "prodstorageaccount"
    },
    "location": {
      "value": "eastus"
    }
  }
}

Resource Dependencies and Deployment Order

ARM templates automatically determine deployment order based on resource dependencies. Use the dependsOn element to explicitly define dependencies when needed. ARM evaluates dependencies and deploys resources in parallel where possible. Common patterns: a VM depends on a virtual network, a database depends on a server. Circular dependencies are not allowed. Use the reference() function to retrieve properties of a deployed resource (e.g., storage account key).

{
  "resources": [
    {
      "type": "Microsoft.Network/virtualNetworks",
      "apiVersion": "2022-01-01",
      "name": "myVNet",
      "location": "[resourceGroup().location]",
      "properties": {
        "addressSpace": {
          "addressPrefixes": ["10.0.0.0/16"]
        }
      }
    },
    {
      "type": "Microsoft.Network/virtualNetworks/subnets",
      "apiVersion": "2022-01-01",
      "name": "[concat('myVNet', '/default')]",
      "dependsOn": [
        "[resourceId('Microsoft.Network/virtualNetworks', 'myVNet')]"
      ],
      "properties": {
        "addressPrefix": "10.0.0.0/24"
      }
    }
  ]
}

Deploying ARM Templates with Azure CLI

Azure CLI is the preferred tool for deploying ARM templates in CI/CD pipelines. Use az deployment group create for resource group deployments, az deployment sub create for subscription-level deployments. Common flags: --template-file, --parameters, --mode (Incremental/Complete). Incremental mode adds resources without removing existing ones; Complete mode deletes resources not in the template. Always use Incremental for production to avoid accidental deletions.

az deployment group create \
  --resource-group myResourceGroup \
  --template-file template.json \
  --parameters @parameters.json \
  --mode Incremental

ARM Template Functions and Expressions

ARM template functions enable dynamic values. Common functions: concat() for string concatenation, uniqueString() for unique names, resourceGroup().location for current region, subscription().subscriptionId. Use brackets [] to wrap expressions. Functions can be nested. For complex logic, use conditions with if(). The deployment() function returns deployment metadata. Always test functions in the Azure portal's template deployment tool.

{
  "variables": {
    "storageName": "[concat('storage', uniqueString(resourceGroup().id))]"
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "[variables('storageName')]",
      "location": "[resourceGroup().location]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2"
    }
  ]
}

ARM Template Best Practices for Production

Production ARM templates should follow these practices: 1) Use parameter files per environment. 2) Validate templates with arm-ttk (ARM Template Toolkit). 3) Use linked templates for modularity. 4) Enable deployment validation in CI/CD. 5) Use tags for cost tracking and management. 6) Implement RBAC via template. 7) Use conditions for feature flags. 8) Avoid hardcoding — use variables and parameters. 9) Test deployments in a sandbox subscription first. 10) Use what-if operation to preview changes.

az deployment group what-if \
  --resource-group myResourceGroup \
  --template-file template.json \
  --parameters @parameters.json

Integrating ARM with CI/CD Pipelines

ARM templates integrate seamlessly with Azure DevOps, GitHub Actions, and other CI/CD tools. In Azure DevOps, use the ARM template deployment task. In GitHub Actions, use azure/arm-deploy action. Store templates in version control. Use pipeline variables for parameter values. Implement approval gates for production. Use deployment slots for zero-downtime updates. Always run linting and validation in the pipeline.

trigger:
- main

pool:
  vmImage: ubuntu-latest

steps:
- task: AzureResourceManagerTemplateDeployment@3
  inputs:
    deploymentScope: 'Resource Group'
    azureResourceManagerConnection: 'myServiceConnection'
    subscriptionId: '...'
    action: 'Create Or Update Resource Group'
    resourceGroupName: 'myResourceGroup'
    location: 'eastus'
    templateLocation: 'Linked artifact'
    csmFile: '$(System.DefaultWorkingDirectory)/templates/template.json'
    csmParametersFile: '$(System.DefaultWorkingDirectory)/templates/parameters.json'
    deploymentMode: 'Incremental'

Troubleshooting ARM Deployments

Common ARM deployment failures: 1) Invalid template syntax — use VS Code extension or arm-ttk. 2) Resource name conflicts — use uniqueString. 3) Quota limits — check subscription quotas. 4) Role-based access errors — ensure service principal has permissions. 5) Dependency issues — check dependsOn. Use az deployment group show to get error details. Enable debug logging with --debug flag. Check activity log in Azure Portal.

az deployment group show \
  --resource-group myResourceGroup \
  --name myDeployment \
  --query properties.error

Beyond ARM: Bicep and Terraform

ARM templates are powerful but verbose. Bicep is a domain-specific language (DSL) that compiles to ARM JSON. It offers cleaner syntax, modularity, and type safety. Terraform is another IaC tool that supports Azure and other clouds. Both are valid alternatives. Bicep is Azure-native and free. Terraform is multi-cloud. Choose based on your team's needs. For Azure-only shops, Bicep is recommended. For multi-cloud, Terraform.

param storageName string = 'mystorageaccount'
param location string = resourceGroup().location

resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
  name: storageName
  location: location
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'StorageV2'
}

output storageEndpoint string = storageAccount.properties.primaryEndpoints.blob

ARM Template Security and Compliance

Security in ARM templates: 1) Use managed identities instead of keys. 2) Reference secrets from Key Vault. 3) Apply Azure Policy to enforce compliance (e.g., require encryption). 4) Use RBAC to restrict deployment permissions. 5) Enable diagnostic settings for auditing. 6) Use secureString for passwords. 7) Never output secrets. 8) Use deployment scripts for post-deployment configuration securely.

{
  "parameters": {
    "adminPassword": {
      "reference": {
        "keyVault": {
          "id": "/subscriptions/.../resourceGroups/myRG/providers/Microsoft.KeyVault/vaults/myVault"
        },
        "secretName": "adminPassword"
      }
    }
  }
}

ARM Template Deployment Scenarios

Common deployment scenarios: 1) Greenfield — deploy entire environment from scratch. 2) Brownfield — update existing resources. 3) Blue-green — deploy parallel environments and swap. 4) Canary — deploy to a subset of resources. 5) Disaster recovery — deploy to secondary region. Each scenario requires different parameterization and deployment mode. Use conditions and expressions to handle variations.

{
  "parameters": {
    "deploySecondaryRegion": {
      "type": "bool",
      "defaultValue": false
    }
  },
  "resources": [
    {
      "condition": "[parameters('deploySecondaryRegion')]",
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "[concat('storage', uniqueString(resourceGroup().id), 'secondary')]",
      "location": "westus",
      "sku": {
        "name": "Standard_GRS"
      },
      "kind": "StorageV2"
    }
  ]
}