Azure Resource Manager

Azure Resource Manager (ARM) is the management layer for provisioning, configuring, and managing Azure cloud resources. ARM provides a consistent management layer that enforces access control, dependency ordering, and idempotent deployments across the Azure platform. Below is a conceptual diagram showing how clients interact with ARM and how it orchestrates resource providers to create and manage managed resources.

How ARM works (control/management plane)

When you submit a management operation from the Azure Portal, Azure CLI, Azure PowerShell, REST API, or an SDK, the request follows this path:

The client sends the request to Azure Resource Manager.
ARM authenticates and validates the request, applies Role-Based Access Control (RBAC) checks, and enforces policy.
ARM orchestrates calls to the appropriate resource providers to create, update, or delete resources.
ARM maintains consistency, dependency resolution, and idempotency for deployments.

This flow ensures you have a single, consistent control plane for resource lifecycle management, separate from the data plane used for service-level operations (for example, reading or writing data to a storage account).

Concept	Purpose
Management plane	Create, update, configure, and delete resources (this is ARM)
Data plane	Service-specific operations like reading/writing data (separate endpoints)
Idempotency	Reapplying the same deployment yields the same state
Dependency ordering	ARM ensures resources are created/updated in the correct order

Key capabilities ARM provides:

Capability	Description
Role-Based Access Control (RBAC)	Fine-grained access management per subscription, resource group, or resource
Resource groups	Logical containers for grouping related resources and managing lifecycle
Tags	Key/value metadata for organization and cost allocation
Resource locks	Prevent accidental deletion or modification
Declarative templates	ARM templates enable repeatable, versioned deployments
Automation integration	Works with Portal, CLI, PowerShell, REST API, and SDKs

Previously, Azure used the Azure Service Management (ASM or “classic”) model. ASM lacked many ARM features such as resource groups, RBAC, locks, and tags. ARM is the modern, recommended resource management model.

ARM templates: declarative infrastructure as code

ARM templates are JSON-based, declarative files that describe the resources you want to deploy and their configuration. You define the desired state, and ARM takes care of creating or updating resources to reach that state. Important characteristics of ARM templates:

Declarative: Describe what you want, not the steps to create it.
Idempotent: Running the same template repeatedly produces the same result.
Parameterized: Accept inputs to reuse templates across environments.
Composable: Support linked templates and nested deployments for complex scenarios.
Deployment scopes: Resource group, subscription, management group, and tenant.

A minimal ARM template contains these top-level sections:

$schema: URI that defines the template schema
contentVersion: Template version
parameters: Inputs to customize the deployment
variables: Derived or constant values used within the template
resources: The resource definitions to create or update
outputs: Values returned after deployment

Example: a simple ARM template that deploys a storage account (trimmed for brevity):

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "storageAccountName": {
      "type": "string",
      "metadata": {
        "description": "Name of the storage account"
      }
    },
    "location": {
      "type": "string",
      "defaultValue": "eastus"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Storage/storageAccounts",
      "apiVersion": "2022-09-01",
      "name": "[parameters('storageAccountName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Standard_LRS"
      },
      "kind": "StorageV2",
      "properties": {}
    }
  ],
  "outputs": {
    "storageAccountId": {
      "type": "string",
      "value": "[resourceId('Microsoft.Storage/storageAccounts', parameters('storageAccountName'))]"
    }
  }
}

How to deploy ARM templates

You can deploy ARM templates from multiple tools and scopes. Common commands:

Tool	Example command
Azure CLI (resource group)	`az deployment group create --resource-group <RG_NAME> --template-file template.json`
Azure CLI (subscription)	`az deployment sub create --location <LOCATION> --template-file template.json`
PowerShell (resource group)	`New-AzResourceGroupDeployment -ResourceGroupName <RG_NAME> -TemplateFile template.json`
PowerShell (subscription)	`New-AzSubscriptionDeployment -Location <LOCATION> -TemplateFile template.json`
Portal	Use “Deploy a custom template” in the Azure Portal
REST API / SDKs	Use the Deployment operations endpoints in the Azure Resource Manager REST API or the corresponding SDK methods

Bicep — a concise authoring experience

While ARM templates are JSON-based, Microsoft provides Bicep, a domain-specific language that offers a more concise and readable syntax and compiles to standard ARM JSON templates.

Learn more: https://learn.microsoft.com/azure/azure-resource-manager/bicep/overview

ARM is the control/management plane. Data plane operations (for example, storage data reads/writes) use separate service endpoints and authentication models; ARM controls resource creation, configuration, and permissions.

Summary

Azure Resource Manager is the central management plane for Azure. It validates and authorizes management requests, enforces RBAC and policies, and orchestrates resource provider operations to create, update, or delete resources. ARM templates (or Bicep) let you define those resources declaratively so you can automate, version, and reuse your infrastructure deployments.

Links and references

Azure Resource Manager overview: https://learn.microsoft.com/azure/azure-resource-manager/management/overview
ARM template structure and reference: https://learn.microsoft.com/azure/azure-resource-manager/templates/overview
Bicep overview: https://learn.microsoft.com/azure/azure-resource-manager/bicep/overview
Azure CLI: https://learn.microsoft.com/cli/azure/
Azure PowerShell: https://learn.microsoft.com/powershell/azure/overview

Introduction

Administer Identity

Administer Governance and Compliance

Administer Azure Resources

Administer Virtual Networking

Administer Intersite Connectivity

Administer Network Traffic

Administer Azure Storage

Administer Azure Virtual Machines

Administer PaaS Compute Options

Administer Data Protection

Administer Monitoring

Azure Resource Manager

How ARM works (control/management plane)

ARM templates: declarative infrastructure as code

How to deploy ARM templates

Bicep — a concise authoring experience

Summary

Links and references

Watch Video

​How ARM works (control/management plane)

​ARM templates: declarative infrastructure as code

​How to deploy ARM templates

​Bicep — a concise authoring experience

​Summary

​Links and references

Watch Video

How ARM works (control/management plane)

ARM templates: declarative infrastructure as code

How to deploy ARM templates

Bicep — a concise authoring experience

Summary

Links and references