3.1AZ-104Intermediate
Est: ~15 mins•Verified: 2026-08

Virtual Machines: Availability Zones & Azure Bastion

Deploy highly available Azure Virtual Machines across Availability Zones, configure Availability Sets (Fault/Update Domains), and enforce secure browser-based RDP/SSH via Azure Bastion.

Tags:#Azure VM#Compute#Availability Zones#Bastion#High Availability#AZ-104
01

Overview

Deploying enterprise workloads on Azure Virtual Machines (IaaS) requires balancing resilience, Service Level Agreements (SLAs), and perimeter security:

  1. Availability Zones (99.99% SLA): Physically separate datacenters within the same Azure region, each with independent power, cooling, and networking.
  2. Availability Sets (99.95% SLA): Logical groupings within a single datacenter isolating VMs across Fault Domains (physical racks/power) and Update Domains (maintenance reboot cycles).
  3. Azure Bastion: Fully managed PaaS proxy providing seamless and secure RDP and SSH connectivity directly through the Azure portal over SSL (port 443). Eliminates the need to assign public IP addresses to virtual machines or open management ports (3389/22) to the public internet.

---

02

When to Use: High Availability Architecture

High Availability OptionSLA LevelFailure Scope Protected Against
Availability Zones99.99%Entire datacenter building failure (flooding, power outage, fiber cut).
Availability Set99.95%Hardware rack failure (Fault Domain) or OS host patch reboot (Update Domain).
Single VM (Premium SSD)99.9%Storage hardware failure (no protection against host reboot).

---

03

Prerequisites

Network Requirements:

  • Virtual Network with an address space.
  • A dedicated subnet named strictly AzureBastionSubnet with at least /26 prefix.
  • Azure Standard Public IP address (Static).

---

04

Portal Path

TEXT
Azure Portal (https://portal.azure.com)
├── Virtual machines
│   └── Create > Azure virtual machine
│       ├── Availability options: Availability zone (1, 2, or 3)
│       └── Disks: Premium SSD v2 / Ultra Disk
└── Bastions
    └── Create > Link to VNet and AzureBastionSubnet

---

05

Step-by-Step Implementation

Step 1: Create Azure Bastion Host Subnet & Resource

  1. Open the target Virtual Network > Subnets > Click + Subnet.
  2. Name: Strictly enter AzureBastionSubnet (Mandatory naming convention).
  3. Starting address: /26 prefix (e.g., 10.0.1.0/26).
  4. In Azure Portal search bar, search Bastions > Click Create.
  5. Name: bastion-core-prod | Tier: Standard (or Basic).
  6. Select your Virtual Network > Create new Public IP pip-bastion-prod (Standard SKU, Static).
  7. Review and create.

Step 2: Deploy an Azure VM in an Availability Zone

  1. Search Virtual machines > Click Create > Azure virtual machine.
  2. Basics:
  • Virtual machine name: vm-web-prod-01.
  • Region: East US.
  • Availability options: Availability zone > Availability zone: Zone 1.
  • Security type: Trusted launch virtual machines.
  • Image: Windows Server 2022 Datacenter: Azure Edition.
  • Public inbound ports: None (Zero public IP).
  1. Under Networking: Select your VNet and workload subnet.
  2. Review and deploy.

Step 3: Connect via Azure Bastion (Zero Public IP)

  1. In Azure portal, open the newly created VM vm-web-prod-01.
  2. Click Connect > Select Bastion.
  3. Enter local VM admin username and password.
  4. Click Connect.
  5. A new browser tab opens rendering a fully interactive high-definition RDP session over HTTPS.

---

06

PowerShell Automation

Deploy Virtual Machine across Availability Zones:

PowerShell
# Create VM in Availability Zone 1
$VMConfig = New-AzVMConfig -VMName "vm-prod-z1" -VMSize "Standard_D2s_v5" -Zone "1"
$VMConfig = Set-AzVMOperatingSystem -VM $VMConfig -Windows -ComputerName "vmprodz1" -Credential $Cred
$VMConfig = Set-AzVMSourceImage -VM $VMConfig -PublisherName "MicrosoftWindowsServer" -Offer "WindowsServer" -Skus "2022-Datacenter" -Version "latest"
$VMConfig = Add-AzVMNetworkInterface -VM $VMConfig -Id $NIC.Id
New-AzVM -ResourceGroupName "rg-compute" -Location "eastus" -VM $VMConfig

---

07

Verification Checklist

VERIFICATION CHECKLIST
0/4 (0%)
VM is successfully deployed in specified Availability Zone (Zone 1).
Network Interface carries zero Public IP addresses.
Azure Bastion connects successfully through browser over port 443.
RDP port 3389 and SSH port 22 are blocked at the perimeter NSG.
08

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
Cannot create Bastion subnetSubnet was not named exactly AzureBastionSubnet or prefix smaller than /26.Delete subnet and recreate with name AzureBastionSubnet and /26 CIDR.
Zone allocation failureTarget Azure region has temporary compute quota capacity limits in that specific zone.Select a different Availability Zone (Zone 2 or 3) or deploy in paired region.

---

09

AZ-104 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Bastion Subnet Name: The subnet name must be AzureBastionSubnet and must be at least /26.
  2. Fault Domains vs Update Domains: Fault Domains (FD) protect against hardware/power failure (up to 3 in a set); Update Domains (UD) protect against planned host reboots (up to 20).
  3. Zonal vs Zone-Redundant: Zonal pins a resource to a single specific zone; Zone-Redundant replicates across multiple zones automatically.

---

10

Official Documentation

PREVIOUS TOPIC2.2 Azure Files, Azure File Sync & Storage Private EndpointsNEXT TOPIC3.2 Azure VM Scale Sets (VMSS) & Azure App Services