Nordlicht Reisen GmbH, a fictional travel agency, is setting up a new operations environment for the booking portal. It should come from one template so that it can be repeated: a resource group with tags, a virtual network with two subnets and a network security group, a storage account, a small virtual machine, monitoring with an alert rule, a backup vault, a role assignment, and a policy. Afterward you check everything and clean it up. The project combines material from the areas of identity, storage, compute, networking, monitoring, and backup.
Prior knowledge: This project assumes lessons 1.3 (roles), 1.5 (policies and tags), 2.1 (storage accounts), 3.2 (Bicep), 3.3 (virtual machines), 4.1 and 4.3 (networks and NSGs), 5.3 (alerts), and 5.5 (Azure Backup). None of that is explained again here; the lessons name the terms only where you apply them.
The goal at a glance
| Building block | Resource type | Why |
|---|---|---|
| Network security group | Microsoft.Network/networkSecurityGroups |
allows only inbound HTTPS (lesson 4.3) |
| Virtual network with two subnets | Microsoft.Network/virtualNetworks |
app with the group, data without (lesson 4.1) |
| Storage account | Microsoft.Storage/storageAccounts |
without public blob access (lesson 2.1) |
| Network interface and VM | Microsoft.Network/networkInterfaces, Microsoft.Compute/virtualMachines |
the application machine, without a public IP address (lesson 3.3) |
| Log Analytics | Microsoft.OperationalInsights/workspaces |
destination for logs (lesson 5.2) |
| Action group and alert rule | Microsoft.Insights/actionGroups, Microsoft.Insights/metricAlerts |
reports high CPU load (lesson 5.3) |
| Backup vault | Microsoft.RecoveryServices/vaults |
destination for the VM backup (lesson 5.5) |
| Role assignment | Microsoft.Authorization/roleAssignments |
Reader for a group (lesson 1.3) |
| Policy assignment | Microsoft.Authorization/policyAssignments |
audits managed disks (lesson 1.5) |
You create the resource group before the template with a command (lesson 3.2): a group-level template cannot create the group itself, and a subscription-level template would need a second file. You set the group's tags right then.
You turn on the VM backup after the deployment with a command; writing it into the template requires nested resources with their own naming rules, which go beyond the exam material.
What you bring: an Entra group whose object ID you know (lesson 1.1; it gets the Reader role), an SSH key pair (ssh-keygen -t rsa -b 4096 -f ./abschluss-key), a VM size that your quota allows (lesson 0.1), and your email address for the alert.