In the AZ-104 compute domain (20–25%), the "create and configure virtual machines" item covers more than creating a VM. It includes "manage virtual machine sizes," "manage virtual machine disks," and "move a virtual machine to another resource group, subscription, or region," and the April 2026 revision replaced the old "configure Azure Disk Encryption" with "configure encryption at host for Azure virtual machines." Our question bank keeps returning to operational questions such as "the size you want isn't in the list" and "what changes when a VM moves to another subscription?"
This article focuses on the operations you perform after a VM exists: the difference between the two kinds of "stopped" and how they're billed, when resizing triggers a restart or requires deallocation, managed disk types and expansion rules, disk encryption now centered on encryption at host, and the rules for moving between resource groups, subscriptions, and regions. The basics of availability sets, availability zones, and scale sets are covered first in Virtual Machines and Deployment Automation.
---
VM Power States and Billing: There Are Two Kinds of "Stopped"
If you just park a rental car in the lot, the rental fee keeps running; only returning the car stops it. But once you return it, there's no guarantee you'll get the same car next time. "Stopping" an Azure VM works the same way.
!Stopping and deallocating a VM differ in billing and in what remains
| State | How it happens | Compute billing | What to remember | |------|------|------|------| | Running | The VM is operating | Billed | Normal state | | Stopped (allocated) | Shut down from inside the OS, or the PowerOff API is called | Still billed | The VM keeps its hardware, so costs continue | | Stopped (deallocated) | Stop in the portal, or the deallocate operation | Not billed | Disk and networking charges continue |
Deallocating returns the hardware lease, so a few things go with it. Dynamic IP addresses are released, and data on the temporary disk (such as drive D: on Windows) can be lost during deallocation, redeployment, or maintenance. The OS disk and data disks, on the other hand, are managed disks and stay intact.
Exam tip: "Eliminate VM compute costs outside business hours" means deallocating the VM (Stop in the portal), not shutting it down from inside the OS. If "the public IP changes after the VM is stopped and started," the IP uses dynamic allocation and should be changed to static.
---
Resizing a VM: Restart Always, Deallocation Sometimes
You can change a VM's size whether it's running or deallocated, but resizing a running VM always restarts it. That's why resizing should be treated as a disruptive operation for stateful workloads.
| Situation | What to do | |------|------| | The new size is available on the current hardware cluster | Change it while running (the VM restarts automatically) | | The new size isn't in the list (not supported by the current cluster) | Deallocate the VM, then change it (it can be placed on another cluster) | | The VM is in an availability set and the new size isn't on the cluster | Deallocate every VM in the availability set, then change it | | A change that switches a Windows VM between having and not having a temp disk | Not supported (only temp disk ↔ temp disk, or none ↔ none) |
Exam tip: If "the size you want doesn't appear in the portal's size list," deallocate the VM and look again; more sizes appear. If the question involves an availability set, the right answer is "stop (deallocate) every VM in the set."
---
Working With Managed Disks
A VM's disks fall into three roles: the OS disk, data disks, and the temporary disk. The temporary disk isn't a managed disk and is meant for short-lived data such as page files or tempdb. OS and data disks use one of five managed disk types.
| Disk type | Good fit | Usable as OS disk | |------|------|------| | Ultra Disk | Top-tier I/O-intensive workloads (SAP HANA, large databases) | No | | Premium SSD v2 | Production needing low latency and finely tuned performance | No | | Premium SSD | Production and performance-sensitive workloads | Yes | | Standard SSD | Web servers, light applications, dev/test | Yes | | Standard HDD | Backups and noncritical sequential I/O workloads | Yes, but retiring on September 8, 2028 |
Disks can only grow; they can't be shrunk Data disks can sometimes be grown without deallocating the VM using "expand without downtime"; otherwise, deallocate and then expand Switching between Premium SSD, Standard SSD, and Standard HDD is allowed twice per day, and for an attached disk you usually deallocate the VM first Most conversions to or from Ultra Disk aren't possible directly, so you create a new disk and move the data A snapshot is a point-in-time copy of a disk; create a new disk from it to restore, or attach it to another VM
Exam tip: "Switch the OS disk to Ultra Disk for better performance" is an impossible option. To speed up an OS disk, move it to Premium SSD. "Shrink a 128-GiB data disk to 64 GiB" isn't supported either.
---
Disk Encryption: Encryption at Host Is the New Baseline
Azure Disk Encryption (ADE) left the April 2026 skills outline and encryption at host came in because of ADE's retirement schedule. Microsoft plans to retire ADE on September 15, 2028; after that date, disks encrypted with ADE won't unlock when the VM restarts. Microsoft recommends encryption at host for new VMs.
| Method | How it works | What to remember | |------|------|------| | Server-side encryption (SSE) | Always encrypts managed disk data when it's stored | Platform-managed keys by default, customer-managed keys through a disk encryption set; doesn't cover temp disks or caches | | Encryption at host | Encrypts temp disks and disk caches at the VM host and sends data to storage already encrypted | Register the EncryptionAtHost feature on the subscription; deallocate existing VMs before enabling | | Azure Disk Encryption (ADE) | Encrypts inside the VM with BitLocker or DM-Crypt, keys in Key Vault | Retiring September 15, 2028; migrate to encryption at host | | Confidential disk encryption | Binds disk keys to the VM's TPM so only that VM can access them | Only for confidential VM sizes |
Encryption at host and ADE can't be used together A VM that has ever used ADE can't simply turn on encryption at host; it must follow a migration procedure The order to enable encryption at host is: register the feature → deallocate (for an existing VM) → enable encryption at host in the VM's disk settings → start
Exam tip: "Temp disks and disk caches must also be encrypted at rest" means encryption at host. SSE alone doesn't encrypt the temp disk. "Encrypt at the OS level with BitLocker inside the VM" describes ADE, but it's unlikely to be the right answer for a new design.
---
Moving a VM: Resource Group, Subscription, or Region
Moving to a different office in the same building is a very different job from relocating to another city. Likewise, moving a VM to a new resource group or subscription is a different process from moving it to a new region.
| Item | Resource group or subscription move | Region move | |------|------|------| | What changes | The resource ID (the subscription ID or resource group name part) | The physical location; new resources are created | | What stays the same | The physical region and host; the VM keeps running | The source remains until you delete it after committing | | Tool | Move in the portal, Move-AzResource, az resource move | Azure Resource Mover | | Restrictions during the move | Source and target resource groups are locked; no create, delete, or update | Proceeds step by step with changing states |
Conditions that often appear for resource group and subscription moves:
Moving across subscriptions requires both subscriptions to be in the same Microsoft Entra tenant The target subscription must be registered for the resource provider To move a VM in an existing VNet to another subscription, the VNet and its dependent resources must move too VMs created from Marketplace images with plans can't move across subscriptions A VM configured with Azure Backup can move only after you delete the restore point collections (snapshots) from the vault The resource ID changes after the move, so update references in scripts, templates, and dashboards
Region moves are handled by Azure Resource Mover, which analyzes dependencies and works in stages: select resources → validate dependencies → prepare → initiate move → commit (or discard) → delete source. You can discard the move any time before committing.
Exam tip: "Moving a VM to another resource group moves it to a different host in a different region" is false. A resource group move changes only the administrative grouping; the physical location stays the same. When the requirement is to change regions, choose Resource Mover.
---
Exam Quick Reference
Key points to check one last time before the exam.
| Topic | What to remember | |------|------| | Stopped (allocated) vs deallocated | Compute still billed vs billing stops (disk and network charges remain) | | Lost on deallocation | Dynamic IPs, temp disk data | | Resizing | Restarts if running; deallocate first if the size isn't listed | | Resizing in an availability set | If the size isn't on the cluster, deallocate every VM in the set | | Not usable as OS disk | Ultra Disk, Premium SSD v2 | | Disk size | Grow only, never shrink | | Standard HDD OS disks | Retiring September 8, 2028 | | Encryption at host | Encrypts temp disks and caches too; register EncryptionAtHost; deallocate existing VMs | | ADE | Retiring September 15, 2028; can't be combined with encryption at host | | Resource group or subscription move | Only the resource ID changes; region and host stay; same tenant required | | Move restrictions | Marketplace plan VMs can't cross subscriptions; delete Backup restore point collections fir