Azure Resource Manager (ARM) Overview

Azure Resource Manager (ARM) is the deployment and management service for Azure. Every interaction with Azure — whether through the portal, CLI, SDKs, or IaC tools — passes through ARM. Understanding ARM is essential for writing effective Infrastructure as Code on Azure.

---

What is Azure Resource Manager?

ARM is the control plane for Azure. It receives all API requests, authenticates and authorises them, and then forwards them to the appropriate resource provider (e.g., Microsoft.Compute for VMs, Microsoft.Storage for storage accounts).

Azure Portal
Azure CLI         →  Azure Resource Manager  →  Resource Provider  →  Resource
Bicep / ARM JSON                                  (e.g., Microsoft.Compute)
Terraform

Key Responsibilities

• Authentication and authorisation — validates identity and RBAC permissions
• Request routing — sends requests to the correct resource provider
• Deployment orchestration — manages dependencies and parallel creation
• Template processing — evaluates ARM/Bicep templates and executes deployments
• State tracking — maintains the current state of all Azure resources

---

Core Concepts

Resource Groups

A resource group is a logical container that holds related Azure resources. Every resource must belong to exactly one resource group.

az group create --name rg-webapp-prod --location uksouth

Resource groups provide:

• Lifecycle management — delete a resource group to remove all its resources
• Access control — assign RBAC roles at the resource group level
• Cost tracking — view costs by resource group
• Tagging — apply metadata tags for organisation

Subscriptions

A subscription is a billing and access boundary. An Azure account can have multiple subscriptions to separate workloads, departments, or environments.

Tenant (Entra ID)
  └── Subscription (billing boundary)
        └── Resource Group (logical container)
              └── Resource (VM, storage, etc.)

Management Groups

Management groups sit above subscriptions and allow you to organise subscriptions into a hierarchy. You can apply Azure Policy and RBAC at the management group level.

---

ARM Deployments

An ARM deployment is the act of submitting a template to ARM for processing. Deployments can target different scopes:

Scope	Command	Use case
Resource group	az deployment group create	Most common — deploy resources into a resource group
Subscription	az deployment sub create	Create resource groups, apply policies
Management group	az deployment mg create	Apply governance across subscriptions
Tenant	az deployment tenant create	Set up management group hierarchy

Resource Group Deployment Example

az deployment group create \
  --resource-group rg-webapp-prod \
  --template-file main.json \
  --parameters @parameters.prod.json

Deployment Modes

ARM supports two deployment modes:

Mode	Behaviour
Incremental (default)	Adds or updates resources in the template; leaves existing resources untouched
Complete	Adds or updates resources in the template; deletes resources not in the template