Azure Resource Manager (ARM) - Infrastructure-as-Code

What is Azure Resource Manager?

Azure Resource Manager (ARM) is the fundamental deployment and management layer for all Azure resources. Every API call, every portal action, and every CLI command runs through ARM. ARM authenticates and authorizes requests before forwarding them to the appropriate Azure service, providing a unified management interface across all Azure services.

The core of ARM is the Infrastructure-as-Code paradigm: instead of manually creating resources in the portal, you define your desired infrastructure in declarative templates (ARM Templates as JSON, or Bicep as a Domain-Specific Language that compiles to ARM JSON). ARM compares the target state defined in the template with the current state and only makes the necessary changes (idempotent deployments).

ARM has four management scopes: management groups, subscriptions, resource groups, and individual resources. Resource groups are logical containers for related resources with a shared lifecycle and enable bulk operations, tagging, RBAC at the group level, and deployment tracking. Management groups form higher-level hierarchies for enterprise governance with Azure Policies and RBAC inheritance across multiple subscriptions. Settings such as policies are inherited from higher to lower scopes.

Core Features

Declarative Infrastructure-as-Code: Define infrastructure via ARM templates (JSON) or Bicep, including dependency resolution between resources.

Resource groups and management groups: Four scope levels (management group, subscription, resource group, resource) for structured management and inherited governance settings.

RBAC and Azure Policy: Native integration of role-based access control along with a policy engine to enforce compliance rules (e.g., allowed regions, required tags).

Resource locks: ReadOnly and CanNotDelete locks protect critical resources from accidental modification or deletion, even for users with Owner permissions.

Tagging: Labeling resources for cost allocation and organization, which can be evaluated through cost management features.

What-If deployments: Preview planned changes before actually executing a deployment.

Typical Use Cases

Infrastructure-as-Code for multi-tier applications: DevOps teams define complete environments (network, VMs, databases, storage) in Bicep templates and deploy identically configured development, staging, and production environments with environment-specific parameters.

Resource tagging for cost allocation: Enterprises tag resources with cost center, environment, and owner and evaluate costs by tag in Azure Cost Management. Azure Policy can block deployments that lack required tags.

Role-based access control via resource groups: Development teams receive different permissions (e.g., Contributor in development, Reader in production) through RBAC assignments at the resource group level.

Resource locking for production protection: Critical production resources such as databases or storage accounts are protected from accidental deletion with CanNotDelete locks.

Policy-based governance via management groups: Enterprises define Azure Policies (e.g., allowed regions, required tags) at the management group level, which are inherited by all subordinate subscriptions.

Best Practices for Azure Resource Manager

Use Bicep instead of ARM JSON: Bicep is Microsoft’s recommended DSL for Infrastructure-as-Code, compiles to ARM JSON, and is significantly more readable than nested JSON. Existing ARM templates can be migrated with bicep decompile.

Resource groups as lifecycle units: Group resources with a shared lifecycle in the same resource group so they can be created, updated, and deleted together.

What-If before production deployments: Run az deployment group what-if to review planned changes before they are actually executed.

Consistent naming conventions: Define uniform naming schemes and enforce them via Azure Policy if needed to make resources easier to identify.

Resource locks for production resources: Enable CanNotDelete locks on critical production resources and combine them with RBAC for additional protection.

Frequently Asked Questions about Azure Resource Manager

What is the difference between ARM Templates and Bicep?

ARM templates are JSON-based infrastructure definitions processed directly by ARM. Bicep is a Domain-Specific Language that compiles to ARM JSON, is more readable and concise, and supports modules and type safety. Bicep is Microsoft’s recommended approach for new projects.

How do idempotent deployments work?

ARM compares the target state defined in your template with the current state of resources and only makes the necessary changes. Deploying the same template multiple times with the same parameters results in no further changes.

What are resource groups and how should I organize them?

Resource groups are logical containers for Azure resources with a shared lifecycle. A common pattern is one resource group per environment and application, or per workload. Resource groups enable RBAC, tagging, and bulk operations at the group level; deleting a resource group deletes all contained resources.

What are management groups and when do I need them?

Management groups are hierarchical containers above subscriptions for enterprise governance. They enable policy and RBAC assignments at the group level with inheritance to subordinate subscriptions, and are suited for organizations with multiple subscriptions that want to enforce centralized governance rules.

How does resource locking work?

Resource locks prevent accidental deletion or modification of critical resources. ReadOnly locks prevent changes, CanNotDelete locks prevent only deletion. Locks apply at the resource, resource group, or subscription level and take effect even for users with Owner permissions.

Does Azure Resource Manager cost anything?

ARM itself is free. Only the resources managed through ARM (VMs, databases, storage, etc.) are billed; there are no direct fees for resource groups, tags, or RBAC assignments.

How do I integrate ARM deployments into CI/CD?

ARM and Bicep deployments can be automated via Azure Pipelines, GitHub Actions, or other CI/CD tools with Azure CLI integration. Templates are version-controlled in Git, and What-If checks can be integrated into pull request checks.

Integration with innFactory

As a Microsoft Solutions Partner, innFactory supports you in implementing Infrastructure-as-Code with Azure Resource Manager and Bicep. We help with template development, CI/CD integration, and governance strategy.

Contact us for a non-binding consultation on Azure Resource Manager and Infrastructure-as-Code.