This course lives on exercises in your own account. Whoever runs Azure doesn't learn it from text alone, but by creating, viewing, changing and deleting resources. That costs money if you're careless, and almost nothing if you have a few habits. This lesson sets them before the first resource exists: which account you use, how you limit cost, how every exercise ends, and how you check whether your region has room for a machine.

Nordlicht Reisen GmbH, a fictional travel agency, serves as the running example. Your exercises are its operations environment in miniature.

Prior knowledge: What a subscription and a resource group are is covered in "AZ-900 compact", lesson 2.2. How cost arises, how the pricing calculator works and what a budget looks like as a script is taught in K3, lesson 3.1.2. This lesson cuts that down to what you need for the exercises of this course and points you there. Cost management as exam material comes in lesson 1.6.

Note on names in the portal: The Azure portal names things differently depending on its language setting. This course writes the names of the interface in English, as Microsoft calls them in its documentation (for example Subscriptions, Cost Management + Billing, Usage + quotas), and explains them where they first appear. If your portal is set to another language, look for the same item under its translated name; the search box finds both.

Two routes to a practice account

You need a subscription in which you're allowed to create resources. Two routes lead there, and the course works with both.

Route a: the free account (Azure free account). New customers whom Microsoft admits for it get a credit of 200 US dollars in the billing currency for the first 30 days, valid for every service except purchases from third parties in the Marketplace. What you don't use within the 30 days expires. After that, and for up to twelve months after sign-up, you can only use limited amounts of some services for free; in addition, a few services are free permanently. If you switch to pay-as-you-go earlier, you keep the remaining credit until the end of the 30 days.

Route b: a paid subscription with a budget and an alert. If you already have a subscription, for example from work, through Visual Studio or as a student, never use a production system. Create a subscription of your own, empty, for the course, or at least a resource group of your own in a subscription in which nobody works productively. Set a budget with an alert (section "The budget as a second safeguard").

Route a: free account Route b: paid subscription
Cost at first from the credit from the start by usage
Spending limit on by default not available
When it's used up subscription is disabled it keeps running, you pay
Safeguard credit and limit budget with an alert, clean-up
Danger exercises break off a real bill

The table reveals the order of the habits: With the free account, Microsoft protects you until the credit is empty. With a paid subscription, only you protect yourself, through budget and clean-up.

What the free account does: credit, free allowance, limit

The rules of the free account in short form, read on Microsoft Learn (pages under "Further reading"):

  • The credit lasts 30 days. After that, whatever is left expires.
  • The free allowance applies to certain services in certain amounts per month. An unused amount doesn't carry over to the next month. As an example, Microsoft names three machine sizes that may run up to 750 hours a month for free: B1S, B2pts v2 (ARM-based) and B2ats v2 (AMD-based). The exact and current list is in the free account's frequently asked questions (FAQ). Check it before you start, before you rely on a size. This lesson names them only as an example.
  • Multiple instances are allowed as long as the total stays within the limit: 750 hours can be spread across several machines.
  • Regions: As long as you stay within the limit, you may create the free services in any region where they exist.
  • Free services page: Microsoft recommends creating free services through the Free services page in the portal (search for "free services" at the top of the portal). If you create resources elsewhere, the free tier isn't always preselected. Then you choose it yourself.

Whether you're within the limit is shown by the portal: Open Subscriptions, choose the subscription that was created when you signed up for the free account, and read the page. There you find the section Top free services by usage with a table (Free services for 12 months): for each meter, the columns Usage/Limit and Status. Possible states are "Not in use", "Unlikely to Exceed", "Exceeds on <date>" and "Exceeded on <date>". The data appears with a delay of one to two days, and only for the free account's subscription.

The spending limit

With the free account, the spending limit is on by default and equal to the credit. It prevents spending beyond the credit. Three properties matter in practice:

  • You can't change the amount. Either a limit equal to the credit applies, or you remove it. A limit of your own doesn't exist.
  • Reaching it shuts things off. When the spending is used up, your provisioned services are disabled for the rest of the billing period. With the free account, Azure resources are taken out of operation, virtual machines are stopped and deallocated (deallocated), and the data in storage accounts becomes read-only.
  • It doesn't prevent everything. Some external services from the Marketplace can't be paid for with the credit and can cause costs of their own, even with the limit set. Microsoft names Visual Studio licenses, Microsoft Entra ID P1 or P2, support plans and most services from third-party brands. When you create such a service, the portal warns you that it's billed separately.

When the subscription is disabled

If the credit runs out or the 30 days are over, Azure disables the subscription to protect you from spending beyond credit and free allowance. To continue, you switch to pay-as-you-go. You can do that in the portal under Subscriptions: choose the subscription, in the command bar choose Upgrade subscription, add a payment method, give a name, choose a support plan, Upgrade. After that you still have twelve months of access to the free services and pay only for what goes beyond them.

One trap is stated explicitly in the documentation: If you used resources that aren't free, and the subscription was disabled because of that, those resources become active again after the switch, and you pay for their use. So clean up before you switch whatever you no longer need.

A subscription isn't only disabled by an empty credit. An overdue invoice, a reached card limit or a cancellation lead to it as well. After the payment is settled, reactivation can take up to 24 hours. With the free account and no switch, the end of the chain is different: If you remove the spending limit, the free subscription turns into a subscription with pay-as-you-go prices at the end of the free period; you keep the remaining credit for the full 30 days.

Which resources cost money by the hour

A simple distinction is enough for the exercises. The course says for every exercise what is affected, and names no amounts: Prices change, and they depend on region and tier. You estimate amounts yourself in the pricing calculator and on the service's pricing page, with a date, as K3 shows in lesson 3.1.2.

Costs money by the hour as long as it exists Costs practically nothing as long as it's empty
virtual machines (including the disks underneath) resource groups
Load Balancer Standard virtual networks and subnets
Azure Bastion policy and role assignments
App Service plans tags
Azure Backup and Site Recovery per protected instance
Log Analytics data (by volume)

The right column is a rule of thumb, not a guarantee; the lessons say it more precisely at the respective exercise. The left column carries the note "delete immediately after the exercise" in the lessons. A forgotten machine is the most common reason for a surprise on the bill. Note also: For the quota, machines that are stopped but not deallocated keep counting. More on that below.

The budget as a second safeguard

A budget alerts you when cost reaches a threshold. It stops nothing. Cost and usage data are usually available after 8 to 24 hours, and budgets are checked against them every 24 hours; the notification normally arrives within an hour of the check. So more than a day can pass between a mistake and the alert. That is why clean-up is the first safeguard and the budget only the second.

In the portal you create a budget like this: Subscriptions, choose the subscription, in the menu Budgets, Add. You give it a name, choose the period (monthly, quarterly or annually) and the amount, then on the next page alert thresholds in percent with an email address. At least one threshold is required, up to five are possible. With the field Type you choose between Actual (cost incurred) and Forecasted (predicted cost). Add azure-noreply@microsoft.com to your list of safe senders, otherwise the alert ends up in spam.

The budget as a script and the cost tools in detail are K3, lesson 3.1.2, and in this course lesson 1.6. For this lesson it's enough to know: Whoever takes route b creates the budget before the first exercise runs.

One note that K3 also makes: With some offers, such as the free account or student offers, budgets can be restricted. Then, with the free account, the spending limit remains your safeguard. Read the portal's message carefully.

Clean-up: every exercise has its group

The most important habit of this course: Every exercise puts its resources into a resource group of its own, rg-az104-<exercise>, for example rg-az104-konto. At the end you delete exactly this group and check that it's gone. A resource group is the container of an exercise; whatever is in it disappears with it (K3, lesson 3.1.3).

Bash
az group create --name rg-az104-konto --location germanywestcentral --tags kurs=az104

The command is repeatable: If the group already exists, it sets its tags. It rejects a different region for an existing group. Deleting:

Bash
az group delete --name rg-az104-konto --yes --no-wait

--yes skips the confirmation prompt, --no-wait doesn't wait for the end. The command deletes the group with everything in it and can't be undone. So read the name twice. The check that it's gone:

Bash
az group wait --name rg-az104-konto --deleted
az group exists --name rg-az104-konto

az group wait --deleted waits until the group is deleted (defaults: poll every 30 seconds, maximum 3600 seconds). az group exists prints true or false. After the deletion, false must be there.

The same in Azure PowerShell (Az module, whose setup lesson 0.2 shows):

PowerShell
New-AzResourceGroup -Name rg-az104-konto -Location germanywestcentral -Tag @{ kurs = 'az104' }
Remove-AzResourceGroup -Name rg-az104-konto -Force
Get-AzResourceGroup | Where-Object ResourceGroupName -eq 'rg-az104-konto'

Without -Force, Remove-AzResourceGroup asks first; with -AsJob, the deletion runs in the background. The last line prints nothing after the deletion, because there is no group left that the filter matches.

What doesn't disappear with the group. The command deletes the content of the group, nothing else. Things that live outside the group stay: users and groups in the directory, role assignments and policy assignments at a higher level, budgets, backup vaults with data. Every exercise that creates something like that names the clean-up step explicitly under "Cost and clean-up". If a lesson doesn't name one, this applies: You haven't created anything that stays.

Rule for safety: Delete commands in this course never hit anything other than the exercise's group. Before you paste a name, check it with az account show and az group list so that you're in the right subscription and at the right group.

Quota and regions

Ordering a machine doesn't mean that it starts. Two things can prevent it, and Azure checks them separately:

  • The quota is your subscription's permission to create a certain number of vCPUs or machines. It applies per region and in two levels: Total Regional vCPUs and the vCPUs of the respective size family (such as the B family). A new machine may not exceed either level. All cores in use are counted, including those of stopped but not deallocated machines.
  • The capacity is the space actually available in the data center of the region or zone. Even with enough quota, a deployment can fail if the size isn't available there right now. Then another size, zone or region helps.

Check both before the first machine. The CLI shows a region's quota:

Bash
az vm list-usage --location germanywestcentral --output table

The output has one row per quota with the columns Name, CurrentValue and Limit. Among them are Total Regional vCPUs, the number of machines and one row per size family, for example Standard B Family vCPUs. The numbers are different for every subscription. The PowerShell counterpart:

PowerShell
Get-AzVMUsage -Location germanywestcentral

In the portal you find the same values under Subscriptions, choose the subscription, on the left under Settings the item Usage + quotas; there you can filter by region and family. If the quota isn't enough, you can request an increase or delete machines you no longer need. A limit of zero for a family means: In this region you can't create this size until that changes.

Whether a size is offered in the region for your subscription is shown by az vm list-skus. The command takes restrictions at the subscription level into account and therefore gives the most accurate information:

Bash
az vm list-skus --location germanywestcentral --size Standard_B2 --output table

--size also takes parts of the name. With --zone, the command shows only sizes that support availability zones, with --all also those that aren't available for your subscription. Every entry in the output has a list restrictions; it's empty if nothing restricts the size. The reasons Azure gives for restrictions are NotAvailableForSubscription (related to capacity in the data center) and QuotaId (your subscription doesn't belong to the quota group that the size requires).

If the size in the example isn't available or the quota is zero, choose another EU region and stick with it for the whole course. The regions your subscription knows are listed by az account list-locations; which services are offered where is shown on Microsoft's "Products available by region" page. The course uses germanywestcentral as its example. You don't have to guess the regions of the exercises: Where an exercise needs a particular size, it says so, and you check it with the two commands above.

Cost and clean-up

Apart from an empty resource group, this lesson creates nothing.

  • What costs money by the hour: nothing. The group rg-az104-konto is empty.
  • Prices: Where an exercise creates something that costs money, it points to the pricing calculator and the service's pricing page.
  • Clean-up: az group delete --name rg-az104-konto --yes --no-wait, then the check with az group wait --deleted and az group exists.
  • What stays: If you created a budget, it stays, because it hangs on the subscription, not on the group. That is intended: It should also watch the next exercises.

Exercise 1: The throwaway group

  1. Check which subscription you're working in, and create the group rg-az104-konto in germanywestcentral (or your region) with the tag kurs=az104.
  2. Read the group back: name, region, tags.
  3. Delete the group and wait until it's gone.
  4. Run the check.

How to check it: After step 2, the group shows exactly one tag, kurs with the value az104. After step 3, az group exists --name rg-az104-konto prints false.

Solution 1
Bash
az account show --query "{Name:name, Zustand:state}" --output table
az group create --name rg-az104-konto --location germanywestcentral --tags kurs=az104
az group show --name rg-az104-konto --query "{Name:name, Ort:location, Tags:tags}"
az group delete --name rg-az104-konto --yes --no-wait
az group wait --name rg-az104-konto --deleted
az group exists --name rg-az104-konto

The first command prints a table with one row: your subscription's name and its state. With the free account and with an active subscription, Enabled is shown there; if Disabled is shown, the subscription is disabled, see above. The third command prints a JSON object with the three fields. The last command prints false.

The same in Azure PowerShell:

PowerShell
Get-AzContext
New-AzResourceGroup -Name rg-az104-konto -Location germanywestcentral -Tag @{ kurs = 'az104' }
Remove-AzResourceGroup -Name rg-az104-konto -Force
Get-AzResourceGroup | Where-Object ResourceGroupName -eq 'rg-az104-konto'

If the delete command gives an error such as ScopeLocked, a lock is attached to the group. Lesson 1.5 teaches that. In this exercise there shouldn't be one.

Exercise 2: Quota and region

  1. Read your region's quota: the row Total Regional vCPUs and the row of the B family.
  2. Use az vm list-skus to check whether Standard_B2ats_v2 and Standard_B2s (or another size that you plan for the exercises) are offered in your region.
  3. If not: Choose another EU region and check the same sizes there.
  4. In a file az104-konto.md, note your region, your subscription (the name only) and which route you take (a or b).

How to check it: The file names a region in which your planned size is offered and in which Limit minus CurrentValue for Total Regional vCPUs and for the B family is at least the vCPUs of such a machine.

Solution 2
Bash
az vm list-usage --location germanywestcentral --output table
az vm list-skus --location germanywestcentral --size Standard_B2 --output table

The table of the first command has the columns Name, CurrentValue and Limit. You're looking for the rows Total Regional vCPUs and Standard B Family vCPUs. Calculate: Limit minus CurrentValue is the free room. How many vCPUs a size needs is in the size's description (the pages of the size families on Microsoft Learn); you check against that number, not against one the course gives. The table of the second command contains one row per matching size; if a size is restricted for your subscription, that is shown in the entry's restrictions. Whether capacity is free in the data center right now is, in the end, shown only by the deployment itself.

One possible file:

Region: germanywestcentral (or: <your EU region>)
Subscription: <name of the subscription>
Route: a (free account) / b (paid subscription with budget)
Checked on: <date>: B sizes available, quota sufficient.

Whoever finds neither the example size nor another B size in the region takes another EU region, enters it in the file and uses it for all exercises. The commands are the same in all regions.

What you can do now

  • You choose your route: free account or your own subscription with a budget.
  • You know what the credit, free allowance and spending limit of the free account do and what happens when they run out.
  • You recognize which resources cost money by the hour, and you estimate amounts yourself with the pricing calculator.
  • You clean up every exercise with az group delete or Remove-AzResourceGroup and check that the group is gone.
  • You know what doesn't disappear with the group.
  • You check quota and availability of a size and, if needed, choose another EU region.

Further reading