Azure Learning

arm

Properties2
tagsarm, control-plane, management
aliasesARM, Resource Manager, Azure control plane

2 min read

Azure Resource Manager (ARM)

What it is

Azure Resource Manager (ARM) is the deployment and management layer (control plane) for Azure. It’s the single REST service that handles every request to create, read, update, or delete an Azure resource — whether that request comes from the portal, the Azure CLI/Cloud Shell, PowerShell, an SDK, or a template.

Why it exists

Without a single control plane, each tool would talk to each resource type in a different, inconsistent way. ARM gives Azure a consistent, centralized API for management and enforces authentication + authorization (RBAC) on every request, plus declarative deployment so you can describe the end-state instead of the step-by-step commands.

Key ideas

  • Control plane vs data plane — ARM is the management plane (PUT/GET on resource details, RBAC, creation). Access to the data inside a resource (e.g., a blob’s contents, a VM’s OS) is the data plane, handled by the resource itself (often with its own keys/SAS). AZ-104 distinguishes these.
  • AuthN + AuthZ on every call — every ARM request is authenticated via Entra ID and authorized via RBAC before the operation runs.
  • Resource providers — ARM routes requests to the correct resource provider (e.g., Microsoft.Compute, Microsoft.Network, Microsoft.Storage), each of which registers resource types.
  • Declarative templates — ARM templates and Bicep are submitted to ARM as one idempotent PUT describing the goal; ARM builds a dependency-ordered deployment plan.
  • Front-ends are equivalent — portal, CLI, PowerShell, SDKs all funnel into ARM’s REST API.

How it fits (diagram)

arm - Microsoft diagram

Diagrams courtesy of Microsoft Learn / Azure docs: azure-resource-manager/management/overview

Exam notes

  • ARM = control plane; the resource = data plane. Know which operations hit which.
  • RBAC is enforced by ARM at request time — an allowed caller still needs data-plane permissions for the data inside the resource.
  • Templates let ARM deploy declaratively, idempotently, and in dependency order.
  • Resource providers must be registered for the subscription before some resource types can be created.

Path MOC · arm-template · bicep · resource-group · scope · rbac · azure-cli

📘 Source: Microsoft Learn — Arm

Graph View

Backlinks