Microsoft Azure as a Personal VPS: The Complete Guide to Pricing, Setup, and Cost Optimization

Microsoft Azure is one of the world’s largest cloud platforms, second only to AWS in market share. It’s typically thought of as enterprise territory — massive corporations, compliance-heavy deployments, and six-figure contracts. But Azure has a surprisingly compelling story for individual developers, homelab enthusiasts, and small-project runners who want reliable global infrastructure without managing physical hardware.

This guide is your deep dive into Azure as a personal VPS: understanding the VM landscape, decoding the pricing models, getting a server locked down and running from scratch, and — crucially — mastering the strategies that can slash your monthly bill from “ouch” to “fine, actually.”

Why Azure for a Personal VPS?

Before digging into the mechanics, it’s worth asking: why Azure over DigitalOcean, Linode (Akamai), Vultr, or Hetzner?

Reasons Azure wins:

• Global network of 60+ regions — the densest of any cloud provider, great for latency-sensitive side projects
• Free tier generosity — $200 in credits for 30 days plus 12 months of specific free services
• Student and developer programs — legitimate pathways to meaningful free credits
• Azure Hybrid Benefit — if you have enterprise licensing, savings stack aggressively
• Mature ecosystem — DNS, CDN, managed databases, Key Vault, and more all in one place
• Reserved Instance depth — up to 72% off for committed workloads
• Microsoft Entra integration — passwordless SSH and centralized identity management

Where Azure loses:

• The portal UX has a learning curve compared to simpler VPS providers
• Networking concepts (VNets, NSGs, subnets, peering) add complexity for simple use cases
• Pay-as-you-go pricing is not competitive with budget VPS providers like Hetzner
• Billing is opaque at first — unexpected charges from bandwidth, static IPs, and disks surprise new users

The sweet spot for personal Azure use: developers who want cloud-provider-grade features, already have some Microsoft credentials (student, Visual Studio subscriber, enterprise employee), or need to learn Azure professionally while running personal projects.

The Azure VM Landscape: Which Series Is Right for You?

Azure organizes VMs into “series” — families of instances optimized for different workload types. For personal VPS use, you’ll spend most of your time in two families.

B-Series: The Budget Burstable Option

B-series (Burstable) VMs are Azure’s entry-level compute tier. The core concept: when your VM is idle, it accumulates CPU credits. When you need more horsepower, those credits allow temporary bursting above the VM’s baseline CPU allocation.

This maps perfectly to how personal servers actually behave: sitting idle 95% of the time, then spiking when you push code, process a cron job, or serve a burst of traffic.

B-Series tiers useful for personal VPS:

Free tier note: Azure’s free account includes 750 hours/month for 12 months of B1s, B2pts v2 (Arm-based), and B2ats v2 (AMD-based) — effectively one always-on small VM for free for your first year.

B-series is ideal for: personal blogs, low-traffic web apps, home automation servers, code repos, small databases, Discord/IRC bots, API development, CI build agents.

B-series struggles with: media transcoding, sustained high-CPU workloads, large databases under concurrent load.

D-Series: General Purpose Production-Grade

The D-series is Azure’s general-purpose workhorse — faster processors, more RAM per vCPU (typically 4 GiB/vCPU), and consistent performance without the credit-burst model.

Current generation D-series options:

D-series is ideal for: production web servers with sustained traffic, game servers, media servers (Jellyfin/Plex), heavier databases, self-hosted productivity suites (Nextcloud, GitLab).

Latest hardware (2025): The Dasv7-series uses AMD’s 5th Gen EPYC 9005 processors boosted to 4.5 GHz, scaling up to 160 vCPUs and 640 GiB RAM — serious iron when you need it.

Other Series Worth Knowing

Choosing Your Region

Region affects price (East US and West US 2 are typically cheapest), latency, and feature availability. Some newer VM series only appear in certain regions initially.

• US East / US East 2 — cheapest overall, broadest feature availability
• West Europe (Netherlands) — GDPR-friendly, good European latency
• Southeast Asia (Singapore) — best for Asia-Pacific workloads
• Brazil South — only South American option, higher prices

Use the Azure Pricing Calculator to compare region pricing before committing.

Azure Pricing Models: The Full Breakdown

This is where Azure gets interesting — and complicated. There are five distinct ways to pay for VMs, each with different trade-offs between cost and flexibility.

1. Pay-As-You-Go (PAYG)

The default. No commitment, charged by the second. Full flexibility to stop, resize, or delete VMs at any time.

Pros: Maximum flexibility, no upfront cost, no penalty for changing plans Cons: Most expensive baseline — up to 72% more than committed options Best for: Testing, irregular workloads, new projects where you don’t know usage patterns yet

2. Reserved Instances (RIs)

Commit to a specific VM size in a specific region for 1 or 3 years. In exchange, Azure gives you up to 72% off PAYG pricing.

Key details:

• Payment options: all upfront, partial upfront, or monthly payments
• Instance size flexibility: your reservation can apply to other VMs within the same size group/family
• Can be exchanged or cancelled (with fees)
• 1-year savings: ~40–56%; 3-year savings: ~60–72%

Example: A D2s v5 at ~$69/month PAYG drops to ~$39/month on a 1-year reservation and ~$25/month on a 3-year — saving nearly $530/year on a single small VM.

Best for: Any VM you plan to run 24/7 for a year or more — production servers, always-on databases, permanent development environments.

3. Spot VMs

Tap into Azure’s spare capacity at up to 90% off PAYG pricing. The catch: Azure can evict your Spot VM with only a 30-second notice when it needs the capacity back.

Pricing mechanism: You can pay the current fluctuating spot price, or set a maximum hourly price — if spot price exceeds your max, Azure deallocates your VM.

Eviction behavior: VM is either deallocated (stopped, disk preserved) or deleted — choose at creation time.

Personal use cases that work:

• Batch processing jobs (video encoding, data crunching)
• CI/CD build agents that checkpoint work
• Non-critical scheduled tasks
• Machine learning training with checkpointing
• Dev/test environments you can quickly restart

Personal use cases that don’t:

• Production databases
• Any stateful workload where 30-second eviction would cause data loss
• Your primary SSH server you depend on

4. Azure Savings Plans for Compute

A newer, more flexible alternative to Reserved Instances. Instead of committing to a specific VM configuration, you commit to a fixed hourly spend amount (e.g., $1.00/hour) for 1 or 3 years.

Your discount (up to 65%) automatically applies to any eligible compute usage up to your committed spend, across any VM family, region, or OS.

Best for: If your infrastructure evolves frequently (resizing VMs, changing regions, adding new services), Savings Plans are often more practical than RIs even with slightly lower maximum savings.

Pro tip: Azure auto-applies RI discounts first, then Savings Plan discounts — you can combine both in a single environment.

5. Dev/Test Pricing

If you have an active Visual Studio subscription (Standard or Professional), you qualify for Azure Dev/Test pricing — a sustained discount (not one-time credit) on non-production workloads.

Savings: Up to 57% off for typical web app dev/test environments Eligible services: Windows VMs, SQL Database, App Service, Logic Apps, Cloud Services, HDInsight Restriction: Resources must be for development/testing only — no SLA, no production use

This is a hidden gem for professional developers with enterprise Visual Studio subscriptions. Your company’s MSDN/Visual Studio subscription likely already qualifies.

Getting Free Azure Credits: The Complete Playbook

Azure Free Account

Every new Azure account gets:

• $200 in credits valid for 30 days (use on any Azure service)
• 12 months of specific free services (B1s VM 750 hrs/month, 64 GiB SSD disk, 5 GiB blob storage, etc.)
• Always-free tier of smaller services (Functions 1M requests/month, Cosmos DB 1000 RU/s, etc.)

Azure won’t charge you unless you explicitly upgrade to pay-as-you-go. Your $200 credit won’t be charged without consent.

Track remaining credit: Microsoft Cost Management → Cost Analysis → select your subscription.

Azure for Students

If you’re enrolled at an accredited 2- or 4-year institution:

• $100 in credits valid for 12 months (no credit card required)
• Access to free Azure services
• Renews annually as long as you’re enrolled
• Free developer tools via Azure Dev Tools for Teaching
• Available in 140+ countries

Verification is done via your institution’s .edu email address.

Visual Studio Subscriber Credits

Visual Studio subscriptions include monthly Azure credits:

• Visual Studio Professional: $50/month in Azure credits
• Visual Studio Enterprise: $150/month in Azure credits

These credits reset monthly and are separate from your free account. Enterprise subscribers running personal projects effectively get a free VM tier from their employer.

Microsoft Learn Sandbox

For learning Azure services without spending money, Microsoft Learn provides free sandbox environments that spin up temporary Azure subscriptions with pre-allocated resources for completing learning modules. No credit card required — just a Microsoft account.

Summary Table

Initial Setup: From Zero to a Hardened Linux VPS

Step 1: Create Your Azure Account

1. Go to azure.microsoft.com and click Start free
2. Sign in with or create a Microsoft account
3. Complete identity verification (phone + credit card for authorization, not charging)
4. You’re placed in the free tier — $200 credit, 30-day clock starts

Step 2: Create a Virtual Machine

Via Azure Portal:

1. Navigate to Virtual Machines → Create → Azure virtual machine

2. Configure the Basics tab:

   • Subscription: Your free/pay-as-you-go subscription
   • Resource Group: Create a new one (e.g., personal-vps-rg) — resource groups are logical containers for related Azure resources
   • VM Name: e.g., vps-prod-01
   • Region: East US (cheapest, most available)
   • Availability: No infrastructure redundancy (for cost savings on personal VPS)
   • Image: Ubuntu 24.04 LTS (or your preferred distro)
   • VM Size: Start with Standard_B2s or B1ms depending on your needs
   • Authentication: SSH public key (never passwords)
   • SSH key pair name: Azure can generate one or use your existing public key

3. Configure Disks:

   • OS disk type: Standard SSD (good balance of cost/performance for personal use; Premium SSD costs more)
   • Delete OS disk on VM deletion: Check this to avoid orphaned disk charges

4. Configure Networking:

   • Virtual network: Create new or use existing
   • Subnet: default
   • Public IP: Standard SKU static (important — Basic SKU is being retired)
   • NIC Network Security Group: Advanced (lets you configure rules now)
   • Inbound ports: SSH (22) — you’ll restrict this further shortly
   • Accelerated Networking: Enable if your VM size supports it (B2s and above)

5. Management tab:

   • Auto-shutdown: Enable and set a time if this is a dev VM (saves money)
   • Guest OS updates: Enable if you want Azure-managed patching

6. Review + Create → Create

Step 3: Connect to Your VM

Once deployed (usually 1-3 minutes), get the public IP from the VM’s overview page.

1
2
3

# If Azure generated your key pair, download it and:
chmod 400 ~/Downloads/your-key-pair.pem
ssh -i ~/Downloads/your-key-pair.pem azureuser@<PUBLIC_IP>

Step 4: Initial Server Hardening

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19

# 1. Update everything first
sudo apt update && sudo apt upgrade -y

# 2. Install essential tools
sudo apt install -y \
  ufw \
  fail2ban \
  unattended-upgrades \
  curl \
  git \
  htop \
  ncdu \
  tmux

# 3. Create a non-root user (don't run everything as the default azureuser if you want separation)
# azureuser is fine if you disable root login

# 4. Configure SSH hardening
sudo nano /etc/ssh/sshd_config

Recommended /etc/ssh/sshd_config changes:

# Disable password authentication
PasswordAuthentication no
ChallengeResponseAuthentication no

# Disable root login
PermitRootLogin no

# Only allow specific users (replace 'azureuser' with your username)
AllowUsers azureuser

# Use modern key exchange algorithms only
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512

# Reduce idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2

# Disable X11 forwarding if not needed
X11Forwarding no

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15

# Restart SSH (don't close existing session until you test in a new terminal)
sudo systemctl restart ssh

# 5. Configure UFW firewall
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh           # Port 22
sudo ufw allow 80/tcp        # HTTP
sudo ufw allow 443/tcp       # HTTPS
sudo ufw enable
sudo ufw status verbose

# 6. Configure fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

Key fail2ban settings:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

[DEFAULT]
bantime  = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s
maxretry = 3
bantime = 24h

1
2
3
4
5

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

# 7. Enable automatic security updates
sudo dpkg-reconfigure --priority=low unattended-upgrades

Step 5: Configure Azure Network Security Groups (NSGs)

NSGs are Azure’s network-level firewall — they operate before traffic reaches your VM, adding a second layer beyond UFW.

In the Azure Portal:

1. Navigate to your VM → Networking → Network security group
2. Review inbound port rules
3. Delete the default “Allow any SSH” rule if it exists
4. Create a new inbound rule: Source: Your IP address, Destination port: 22, Protocol: TCP, Action: Allow, Priority: 100

This locks SSH to your specific IP — the most effective single action to reduce your attack surface.

For web servers, add:

• Priority 110: Source Any, Port 80, TCP, Allow
• Priority 120: Source Any, Port 443, TCP, Allow

Step 6: Attach a DNS Name (Optional but Recommended)

Rather than remembering your VM’s IP:

1. In the VM overview, click your public IP address
2. Click Configuration
3. Enter a DNS name label (e.g., myserver) — results in myserver.eastus.cloudapp.azure.com

Or point a custom domain: take the IP, add an A record at your DNS provider.

Step 7: Set Up Just-in-Time (JIT) VM Access

JIT is one of Azure’s best security features — it locks SSH/RDP ports at the NSG level and only opens them on-demand for a configured time window (e.g., 3 hours).

1. Navigate to Microsoft Defender for Cloud (formerly Security Center)
2. Go to Workload protections → Just-in-time VM access
3. Click your VM → Enable JIT
4. Configure port 22: Max request time 3 hours, allowed source IP: My IP

When you need to SSH:

1. Go to VM → Connect → My IP → Request access
2. NSG rule temporarily opens port 22 for your IP
3. After 3 hours, rule automatically closes

This means port 22 is closed 99% of the time. Even if someone discovers your IP, they can’t attempt a brute-force attack on a closed port.

Advanced Security: Azure Bastion and Microsoft Entra SSH

Azure Bastion

Azure Bastion provides browser-based SSH/RDP access to VMs without requiring a public IP or open ports. Traffic flows through Azure’s private backbone.

Setup:

1. Create a new subnet in your VNet named exactly AzureBastionSubnet (minimum /26)
2. Deploy Azure Bastion in that subnet (Basic tier: ~$140/month — expensive for personal use)
3. Access VMs via the Azure portal: VM → Connect → Bastion

Cost note: Azure Bastion is overkill for most personal VPS use. JIT + NSG IP restriction achieves similar security at zero additional cost. Bastion is worth it if you need to share access with a team or manage many VMs.

Microsoft Entra (Azure AD) SSH Authentication

For organizations (or developers who want passwordless SSH via Azure identity), you can configure VMs to authenticate via Microsoft Entra:

1
2
3
4
5
6

# Install the Microsoft Entra SSH extension on the VM
az vm extension set \
    --publisher Microsoft.Azure.ActiveDirectory \
    --name AADSSHLoginForLinux \
    --resource-group personal-vps-rg \
    --vm-name vps-prod-01

Then assign yourself the “Virtual Machine Administrator Login” or “Virtual Machine User Login” RBAC role on the VM. SSH becomes:

1

az ssh vm --resource-group personal-vps-rg --vm-name vps-prod-01

No keys to manage, no passwords, access controlled by Azure RBAC and Conditional Access policies. Ideal if you’re using Azure as part of a broader identity management setup.

Networking Fundamentals for Personal VPS

Virtual Networks (VNets) and Subnets

Every Azure VM lives in a VNet and subnet. For a single personal VPS, the defaults work fine. But as you add more VMs, planning your VNet layout pays dividends.

Recommended layout for a small personal setup:

VNet: 10.0.0.0/16 (65,536 addresses)
├── subnet-public: 10.0.1.0/24 (web-facing VMs)
├── subnet-private: 10.0.2.0/24 (databases, internal services)
└── AzureBastionSubnet: 10.0.255.0/26 (if using Bastion)

Static vs Dynamic Public IPs

Azure public IPs come in two types:

• Dynamic: IP may change when VM is deallocated. Cheaper, but breaks DNS records.
• Static: IP is reserved and never changes, even when VM is stopped. Costs ~$3.65/month extra.

For any VM with a domain name pointing at it, use static IPs.

Important: Unattached static public IPs still incur charges (~$0.005/hour). Delete IPs when you don’t need them.

Private DNS and Internal Networking

If you run multiple VMs, use Azure Private DNS Zones to give VMs friendly names:

1. Create a Private DNS Zone: internal.yourdomain.com
2. Link it to your VNet (auto-registration enabled)
3. VMs get A records automatically: vps-prod-01.internal.yourdomain.com
4. Internal VM-to-VM traffic resolves by name, routes privately without leaving Azure

Storage: Understanding Azure Disk Options

Storage costs are a common surprise on Azure bills. Understanding your options prevents overpaying.

Disk Types

For personal VPS: Standard SSD is the sweet spot. Premium SSD is worth it only if your app is I/O bound.

Disk Gotchas

• Disks are charged even when the VM is stopped (deallocated). A 128 GiB Standard SSD costs ~$10/month whether the VM runs or not.
• Snapshot costs: Snapshots are stored as page blobs — ~$0.05/GiB/month. Don’t let snapshots accumulate.
• Temporary storage: VMs include temporary local SSD (/dev/sdb → /mnt/ on Ubuntu) that is free but non-persistent — it wipes on deallocate/resize. Never store important data there.

Cost Optimization Strategies: The Full Arsenal

Strategy 1: Right-Size Your VM

The biggest cost savings come from choosing the right VM size — not too small (causes performance issues) and not too large (wastes money).

Process:

1. Start with what you think you need
2. Run for 2 weeks
3. Check Azure Advisor — it automatically identifies underutilized VMs
4. In Cost Management → Insights → look for “Right-size or shut down underutilized virtual machines” recommendations

Azure Advisor will literally tell you “this VM’s CPU averaged 5% over 30 days — downsize to B1ms and save $X/month.”

Strategy 2: Stop VMs When Not in Use

A stopped-but-not-deallocated VM still charges compute. A deallocated VM charges only storage (disk).

1
2
3
4
5

# Deallocate via CLI (stops billing for compute)
az vm deallocate --resource-group personal-vps-rg --name vps-dev-01

# Start it back up
az vm start --resource-group personal-vps-rg --name vps-dev-01

Auto-shutdown: Enable in VM Settings → Auto-shutdown. Set it to shut down your dev VM at midnight. One click, potentially $30-50/month saved if you forget to stop it manually.

Strategy 3: Switch to Reserved Instances

For any VM you’ve been running for 3+ months and plan to keep running, convert to a Reserved Instance.

Decision framework:

• Running 24/7 for 12+ months → 1-year RI (saves ~40-56%)
• Running 24/7 for 3+ years → 3-year RI (saves ~60-72%)
• Unsure about configuration changes → Azure Savings Plan (saves up to 65%, more flexible)

Buying an RI:

1. Azure Portal → Cost Management + Billing → Reservations
2. Select Virtual Machines
3. Choose VM series, region, term
4. Select payment: upfront (maximum discount) or monthly

Strategy 4: Use B-Series for Intermittent Workloads

If your D-series VM regularly sits at under 40% CPU, you’re probably paying for sustained performance you don’t use. Migrate to B-series equivalent:

• D2s v5 (2 vCPU, 8 GiB) → B2ms (2 vCPU, 8 GiB) = ~50% cost reduction
• The B-series will burst when you need it; you just can’t sustain maximum CPU indefinitely

Strategy 5: Use Spot VMs for Fault-Tolerant Workloads

Any workload that can tolerate interruption should run on Spot:

1
2
3
4
5
6
7
8
9

# Create a Spot VM via Azure CLI
az vm create \
  --resource-group personal-vps-rg \
  --name batch-worker-01 \
  --image Ubuntu2204 \
  --priority Spot \
  --eviction-policy Deallocate \
  --max-price 0.05 \
  --size Standard_D4s_v5

With --eviction-policy Deallocate, your VM is stopped (not deleted) on eviction. With --max-price, you only run when spot price is under $0.05/hour.

Example Spot savings: D4s v5 at PAYG ~$138/month → Spot price often runs ~$14-28/month (80-90% discount).

Strategy 6: Delete Orphaned Resources

The stealthiest Azure costs come from orphaned resources that continue billing after you forget about them:

Hunt for orphaned resources:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# Find unattached disks
az disk list --query "[?diskState=='Unattached']" -o table

# Find unattached public IPs
az network public-ip list --query "[?ipConfiguration==null]" -o table

# Find snapshots older than 30 days
az snapshot list --query "[?timeCreated<'2026-02-01']" -o table

# Find empty resource groups
az group list --query "[?tags.purpose==null]" -o table

Delete anything you don’t recognize or actively need. A single forgotten Premium SSD snapshot or static IP can cost $5-30/month indefinitely.

Strategy 7: Set Budgets and Spending Alerts

Before doing anything else with a new Azure account, set a budget:

1. Azure Portal → Cost Management + Billing → Budgets → Add
2. Set a monthly budget (e.g., $30)
3. Add alert thresholds: 50%, 80%, 100%, and a forecasted 100% threshold
4. Configure email alerts and/or Action Groups (can auto-deallocate VMs when budget is hit)

This is your safety net against runaway charges from forgotten resources.

1
2
3
4
5
6
7
8
9

# Create a budget via CLI
az consumption budget create \
  --amount 30 \
  --budget-name personal-monthly \
  --category Cost \
  --time-grain Monthly \
  --start-date 2026-03-01 \
  --end-date 2027-03-01 \
  --subscription "Your-Subscription-ID"

Strategy 8: Choose the Right Region for Price

Azure pricing varies by region. East US and East US 2 are consistently among the cheapest for most VM sizes. Compare before deploying:

• East US can be 15-25% cheaper than West Europe for the same VM
• Bandwidth egress is usually cheaper from US regions
• Some newer VM series launch in limited regions first, then expand

Use Azure Pricing Calculator to compare regions before creating resources.

Strategy 9: Azure Hybrid Benefit (Enterprise/Commercial Users)

If your organization has Windows Server or SQL Server licenses with Software Assurance, you can apply those licenses to Azure VMs and pay only the base Linux compute rate — saving up to 80% on Windows Server VMs and up to 85% on SQL Server.

Enable during VM creation:

1. Basics tab → Licensing → “Would you like to use an existing Windows Server license?” → Yes

Or enable on existing VMs:

1
2
3
4

az vm update \
  --resource-group personal-vps-rg \
  --name windows-vm-01 \
  --set licenseType=Windows_Server

Note for personal users: Hybrid Benefit requires commercially licensed Software Assurance — most individual users won’t qualify. It’s primarily for enterprise developers running personal Azure subscriptions alongside corporate licensing.

Strategy 10: Use Azure CLI + Terraform for Cost-Conscious IaC

Infrastructure-as-code helps avoid cost surprises because you see exactly what you’re deploying before it runs.

Sample minimal Terraform config for a personal VPS:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

terraform {
  required_providers {
    azurerm = {
      source  = "hashicorp/azurerm"
      version = "~> 3.0"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "personal" {
  name     = "personal-vps-rg"
  location = "East US"
}

resource "azurerm_virtual_network" "main" {
  name                = "personal-vnet"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.personal.location
  resource_group_name = azurerm_resource_group.personal.name
}

resource "azurerm_subnet" "public" {
  name                 = "subnet-public"
  resource_group_name  = azurerm_resource_group.personal.name
  virtual_network_name = azurerm_virtual_network.main.name
  address_prefixes     = ["10.0.1.0/24"]
}

resource "azurerm_network_security_group" "vm_nsg" {
  name                = "personal-vm-nsg"
  location            = azurerm_resource_group.personal.location
  resource_group_name = azurerm_resource_group.personal.name

  security_rule {
    name                       = "SSH-from-home"
    priority                   = 100
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "22"
    source_address_prefix      = var.my_ip_cidr
    destination_address_prefix = "*"
  }

  security_rule {
    name                       = "HTTPS"
    priority                   = 110
    direction                  = "Inbound"
    access                     = "Allow"
    protocol                   = "Tcp"
    source_port_range          = "*"
    destination_port_range     = "443"
    source_address_prefix      = "*"
    destination_address_prefix = "*"
  }
}

resource "azurerm_linux_virtual_machine" "main" {
  name                = "personal-vps-01"
  resource_group_name = azurerm_resource_group.personal.name
  location            = azurerm_resource_group.personal.location
  size                = "Standard_B2s"
  admin_username      = "azureuser"

  admin_ssh_key {
    username   = "azureuser"
    public_key = file("~/.ssh/id_ed25519.pub")
  }

  os_disk {
    caching              = "ReadWrite"
    storage_account_type = "Standard_LRS"
  }

  source_image_reference {
    publisher = "Canonical"
    offer     = "0001-com-ubuntu-server-jammy"
    sku       = "22_04-lts-gen2"
    version   = "latest"
  }

  network_interface_ids = [azurerm_network_interface.main.id]
}

variable "my_ip_cidr" {
  description = "Your home IP in CIDR notation (e.g., 1.2.3.4/32)"
  type        = string
}

With Terraform, terraform plan shows you cost-impacting changes before applying them. Pair with Infracost for automated per-PR cost estimates.

Monitoring and Cost Management in Practice

Azure Cost Management

Navigate to Cost Management + Billing → Cost Analysis for a breakdown of where your money goes.

Useful views to bookmark:

• Cost by resource — find which specific resource is costing most
• Cost by service — spot unexpected services appearing on your bill (often bandwidth, DNS queries, or orphaned IPs)
• Daily cost forecast — see if you’re on track for the month

Azure Advisor Recommendations

Azure Advisor automatically analyzes your environment and provides cost recommendations:

• Shut down or resize underutilized VMs
• Purchase reservations for consistently-running VMs
• Delete unattached disks and IP addresses
• Eliminate duplicate resources

Access via: Home → Advisor → Cost tab

Setting Up Cost Anomaly Alerts

Beyond budgets, Azure Cost Management includes anomaly detection — it learns your spending patterns and alerts you when something unusual happens:

1. Cost Management → Cost Alerts → Add
2. Type: Anomaly
3. Set email recipients
4. Azure will alert you if daily spend suddenly spikes 2x-3x above baseline

This catches scenarios budgets miss — like a VM you thought was stopped that’s actually running, or a Spot VM that got re-provisioned more times than expected.

Building a Cost Dashboard

Azure Dashboards let you pin Cost Management charts for at-a-glance visibility:

1. Go to Cost Analysis, configure a view you like
2. Click Pin to Dashboard (pushpin icon)
3. Create a dedicated “Cost Overview” dashboard with:
   • Current month spend vs budget
   • Daily cost trend (last 30 days)
   • Cost by resource
   • Advisor recommendations count

Common Billing Surprises (And How to Avoid Them)

Bandwidth Egress Charges

Azure charges for outbound data transfer:

• First 100 GiB/month: Free
• Next 9.9 TiB/month: ~$0.087/GiB (East US)
• Traffic between Azure services in the same region: Free

For a personal blog or API server, you’ll almost never hit the free tier limit. But a media server or file storage VM can accumulate real bandwidth charges.

Mitigation: Use Azure CDN to cache content at edge — cached responses don’t count toward VM egress. Use Azure Blob Storage (with CDN) instead of serving large files directly from your VM.

Public IP Charges

Public IP addresses on the Standard SKU are charged at $0.005/hour ($3.65/month) whether the VM is running or not. Dynamic IPs on the Basic SKU are free while deallocated but will be retired.

Mitigation: Delete public IPs when you delete VMs. Use Azure DNS for permanent names and accept IP changes if needed, or factor the static IP cost into your budget.

Premium SSD Charges During VM Deallocation

Even when your VM is stopped (deallocated), the disk keeps billing. A 128 GiB Premium SSD at $21.44/month costs the same whether you’re running 720 hours or 0 hours.

Mitigation: Use Standard SSD instead of Premium SSD unless you actually need the IOPS. Snapshot and delete disks for long-term-paused VMs.

Snapshot Accumulation

Every VM snapshot you take is charged as blob storage (~$0.05/GiB/month). If you have a 128 GiB disk and take weekly snapshots you never clean up, that’s $6.40/month per month of snapshots accumulating.

Mitigation: Set a retention policy. Use Azure Backup instead of manual snapshots — it deduplicates and compresses.

Load Balancer and VNet Gateway Charges

If you follow a tutorial that creates a Load Balancer or VNet Gateway “just in case,” you’ll pay ~$18-200/month for those services even with zero traffic.

Mitigation: Don’t create Load Balancers or VNet Gateways for personal single-VM setups unless you specifically need them.

Practical Monthly Cost Estimates

Scenario 1: Basic Personal Blog / Static Site

Scenario 2: Self-Hosted App + Small Database

Scenario 3: Development Environment (Stopped Nights/Weekends)

Scenario 4: Production Web App (24/7, 3-Year RI)

Azure CLI Cheat Sheet for Personal VPS Management

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44

# Installation (Ubuntu/Debian)
curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash

# Login
az login

# Set default subscription
az account set --subscription "Your Subscription Name"

# List all VMs with status
az vm list -d -o table

# Start / Stop / Deallocate a VM
az vm start -g my-rg -n my-vm
az vm stop -g my-rg -n my-vm          # Stops OS, still charges compute
az vm deallocate -g my-rg -n my-vm    # Stops compute billing

# Resize a VM
az vm resize -g my-rg -n my-vm --size Standard_B2ms

# Get public IP of a VM
az vm show -d -g my-rg -n my-vm --query publicIps -o tsv

# SSH via Azure CLI (with Entra auth)
az ssh vm -g my-rg -n my-vm

# View recent cost breakdown
az consumption usage list \
  --start-date 2026-03-01 \
  --end-date 2026-03-13 \
  --query "[].{Resource:instanceName, Cost:pretaxCost}" \
  -o table

# List unattached disks (potential bill waste)
az disk list --query "[?diskState=='Unattached'].{Name:name, Size:diskSizeGb}" -o table

# Create a snapshot
az snapshot create \
  -g my-rg \
  -n my-vm-snapshot-$(date +%Y%m%d) \
  --source $(az vm show -g my-rg -n my-vm --query storageProfile.osDisk.managedDisk.id -o tsv)

# Delete a resource group (CAREFUL: deletes everything inside it)
az group delete -n old-project-rg --yes --no-wait

Common Use Cases: What Azure Does Well

Docker Host / Container Server

Azure VMs make solid Docker hosts. Pair with Azure Container Registry (ACR) for private image storage:

1
2
3
4
5
6
7
8
9

# Install Docker
curl -fsSL https://get.docker.com | sh
sudo usermod -aG docker $USER

# Login to Azure Container Registry
az acr login --name myregistry

# Run containers as you normally would
docker run -d -p 80:80 --name myapp myregistry.azurecr.io/myapp:latest

ACR has a free tier (Basic: $0.167/day ≈ $5/month) with 10 GiB storage.

Wireguard / VPN Server

An Azure VM makes an excellent personal VPN endpoint — useful for accessing home services securely or anonymizing traffic in a specific region:

1
2
3
4
5
6
7
8

# Install WireGuard
sudo apt install wireguard

# Generate keys
wg genkey | tee privatekey | wg pubkey > publickey

# Configure /etc/wireguard/wg0.conf
# Then: sudo systemctl enable --now wg-quick@wg0

Open UDP port 51820 in your NSG for WireGuard traffic.

Game Server

Azure D-series VMs are popular for personal game servers (Minecraft, Valheim, Palworld). The B4ms (4 vCPU, 16 GiB) is a common choice — burstable for spike moments during player actions, cheaper than the D4s v5 for similar specs.

Use Azure Spot VMs for game servers you only run occasionally — launch a Spot VM before gaming sessions and deallocate after. At 80-90% discount, 20 hours/week of gaming server time costs a fraction of always-on pricing.

Self-Hosted Development Environment

Remote development via VS Code Remote SSH + Azure VM is a compelling workflow:

1. Spin up a D4s v5 (4 vCPU, 16 GiB) for intensive development sessions
2. SSH into it via VS Code Remote SSH extension
3. Deallocate when done for the day
4. Use Reserved Instance or Savings Plan to discount the hours you do run

Your local machine becomes thin-client, development environment lives in the cloud with Azure’s high-bandwidth network.

Decision Matrix: Azure vs. Alternatives

Azure wins when: you’re learning Azure professionally, have access to free credits/student accounts, need enterprise-grade services alongside your VPS, or run committed workloads that benefit from deep RI/Savings Plan discounts.

Azure loses when: you want simple, transparent VPS pricing with no networking complexity. For pure cost efficiency with no commitment, Hetzner is dramatically cheaper.

Summary: Getting the Best Value from Azure

1. Start free: Use the $200 credit and 12-month B1s free tier to experiment before spending real money
2. Right-size ruthlessly: Use Azure Advisor recommendations monthly — don’t pay for unused CPU/RAM
3. Commit to RIs once you’ve been running a VM for 3+ months and know it’s staying
4. Enable auto-shutdown on all dev/test VMs — one click, potentially significant savings
5. Use Spot VMs for any fault-tolerant workload
6. Set spending alerts before doing anything else — surprises on cloud bills are never good
7. Audit orphaned resources monthly: unattached disks, unused IPs, forgotten snapshots
8. Leverage student/Visual Studio credits if eligible — they dramatically change Azure’s economics
9. Use B-series for intermittent workloads and D-series only when you need consistent performance
10. Tag everything — az resource tag applied consistently makes Cost Management views useful

Azure rewards intentional configuration. Approached with cost-awareness from day one, it can be a legitimately affordable, feature-rich alternative to traditional VPS providers — especially for developers building skills on the Microsoft cloud stack.

Further Reading

• Azure Virtual Machine Pricing
• Azure Pricing Calculator
• Azure Reserved VM Instances
• Azure Savings Plan for Compute
• Azure for Students
• Azure Dev/Test Pricing
• Azure Security Baseline for Linux VMs
• Azure VM Sizes Overview
• CloudPrice.net – Real-time Azure VM Comparison