0Pricing
Cloud & IT Cert Prep · Lesson

How Azure Resource Manager Works

Trace a resource creation request through the ARM layer, understand resource groups as logical containers, and learn about ARM's role-based access and audit trail.

How Azure Resource Manager Works is a free Cloud & IT Cert Prep lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cloud & IT Cert Prep learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What Is Azure Resource Manager?

Azure Resource Manager (ARM) is the deployment and management service for Azure. Every action you take in the Azure portal, CLI, PowerShell, or REST API passes through ARM. It acts as a centralised control plane that authenticates, authorises, and routes every resource operation.

The ARM Request Flow

When you send a request to create a resource, ARM intercepts it, verifies your identity via Microsoft Entra ID, checks RBAC permissions, applies any Azure Policy rules, and then forwards the validated request to the appropriate resource provider. The resource provider (e.g., Microsoft.Compute) carries out the actual operation and returns the result to ARM.

# Example: creating a VM via Azure CLI (routed through ARM)
az vm create \
  --resource-group MyRG \
  --name MyVM \
  --image UbuntuLTS \
  --admin-username azureuser

Resource Providers and Resource Types

Azure services are exposed through resource providers, each identified by a namespace such as Microsoft.Storage or Microsoft.Network. Every resource type (e.g., Microsoft.Storage/storageAccounts) must be registered in your subscription before you can create instances of it. Most providers are registered automatically when you first use the related service.

# List registered resource providers
az provider list --query "[?registrationState=='Registered'].namespace" -o table

# Register a provider manually
az provider register --namespace Microsoft.Insights

Resource Groups as Logical Containers

A resource group is a logical container that holds related Azure resources. All resources in a group share the same lifecycle — you can deploy, update, and delete them together. Resource groups also serve as the default scope for RBAC assignments and cost tracking. Every Azure resource must belong to exactly one resource group.

# Create a resource group
az group create --name MyResourceGroup --location eastus

# List all resources in a resource group
az resource list --resource-group MyResourceGroup -o table

ARM and Role-Based Access Control

ARM enforces Role-Based Access Control (RBAC) at every scope: management group, subscription, resource group, or individual resource. Built-in roles like Owner, Contributor, and Reader cover most scenarios. ARM evaluates role assignments from the highest scope downward, and deny assignments can block inherited permissions.

# Assign Contributor role at resource group scope
az role assignment create \
  --assignee user@contoso.com \
  --role 'Contributor' \
  --resource-group MyResourceGroup

The ARM Audit Trail

Every operation routed through ARM is recorded in the Azure Activity Log. The activity log captures who performed the operation, what resource was affected, when the operation occurred, and whether it succeeded or failed. Activity logs are retained for 90 days by default and can be archived to a Storage Account or streamed to Log Analytics for longer retention.

# Query recent ARM operations in activity log
az monitor activity-log list \
  --resource-group MyResourceGroup \
  --max-events 10 \
  --query '[].{time:eventTimestamp, caller:caller, operation:operationName.value, status:status.value}' \
  -o table

Declarative vs Imperative Deployments

ARM supports both declarative and imperative deployment styles. Declarative deployments use ARM templates or Bicep to describe the desired end state; ARM figures out the operations needed to reach it. Imperative deployments use CLI or PowerShell commands step-by-step. Declarative deployments are preferred for repeatability, version control, and idempotency.

# Imperative: create storage account step-by-step
az storage account create \
  --name mystorageaccount \
  --resource-group MyRG \
  --location eastus \
  --sku Standard_LRS

# Declarative: deploy via ARM template
az deployment group create \
  --resource-group MyRG \
  --template-file azuredeploy.json \
  --parameters @azuredeploy.parameters.json

Deployment Modes: Complete vs Incremental

ARM template deployments can run in two modes. Incremental mode (the default) adds or updates resources defined in the template while leaving resources already in the group that are not in the template unchanged. Complete mode deletes any resources in the resource group that are not defined in the template, making the group match the template exactly — use with caution.

# Incremental deployment (default)
az deployment group create \
  --resource-group MyRG \
  --template-file azuredeploy.json \
  --mode Incremental

# Complete deployment (deletes unlisted resources!)
az deployment group create \
  --resource-group MyRG \
  --template-file azuredeploy.json \
  --mode Complete

ARM Template Structure

An ARM template is a JSON document with six main sections: $schema (template version), contentVersion, parameters (inputs), variables (computed values), resources (what to deploy), and outputs (values to return). The resources array contains one object per Azure resource, each specifying the type, API version, name, location, and properties.

{
  '$schema': 'https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#',
  'contentVersion': '1.0.0.0',
  'parameters': {},
  'variables': {},
  'resources': [
    {
      'type': 'Microsoft.Storage/storageAccounts',
      'apiVersion': '2023-01-01',
      'name': 'mystorageaccount',
      'location': '[resourceGroup().location]',
      'sku': { 'name': 'Standard_LRS' },
      'kind': 'StorageV2'
    }
  ],
  'outputs': {}
}

Dependency Management in ARM

When deploying multiple resources, ARM can deploy independent resources in parallel by default, speeding up deployments. When one resource depends on another (e.g., a VM needs a NIC, and the NIC needs a VNet), you declare the dependency explicitly with dependsOn. ARM resolves the dependency graph and sequences operations accordingly.

{
  'type': 'Microsoft.Network/networkInterfaces',
  'name': 'myNic',
  'dependsOn': [
    '[resourceId("Microsoft.Network/virtualNetworks", "myVNet")]'
  ],
  'properties': {
    'ipConfigurations': [{
      'name': 'ipconfig1',
      'properties': {
        'subnet': {
          'id': '[resourceId("Microsoft.Network/virtualNetworks/subnets", "myVNet", "mySubnet")]'
        }
      }
    }]
  }
}

What-If Deployment Analysis

Before running a deployment, use the what-if operation to preview the changes ARM will make without actually making them. The output lists resources that will be created, modified, or deleted, colour-coded by change type. This is particularly valuable before running a complete-mode deployment or making changes to production environments.

# Preview changes before deploying
az deployment group what-if \
  --resource-group MyRG \
  --template-file azuredeploy.json \
  --parameters @params.json

Quick Check

Test your understanding of Microsoft Azure Fundamentals (AZ-900) concepts from this lesson.

Lesson Recap

In this lesson you learned: Azure Resource Manager is the centralised management layer for all Azure resources, resource groups are logical containers that group resources sharing a lifecycle, and ARM deployments can run in incremental or complete mode with what-if preview support. Next up we explore writing ARM templates.

Frequently asked questions

Is the “How Azure Resource Manager Works” lesson free?

Yes — the full text of “How Azure Resource Manager Works” is free to read here on the web, and the Cloud & IT Cert Prep course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cloud & IT Cert Prep course, upgrade to CoddyKit PRO.

What will I learn in “How Azure Resource Manager Works”?

Trace a resource creation request through the ARM layer, understand resource groups as logical containers, and learn about ARM's role-based access and audit trail. You practise Cloud & IT Cert Prep with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cloud & IT Cert Prep?

No prior experience is required. Cloud & IT Cert Prep on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “How Azure Resource Manager Works” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cloud & IT Cert Prep lesson?

Yes. Every Cloud & IT Cert Prep lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. How Azure Resource Manager Works
  2. Writing ARM Templates
  3. Bicep: Modern Azure IaC
  4. Terraform on Azure
← Back to Cloud & IT Cert Prep