Standalone Azure VM production build checklist: single-instance done right

Many customer workloads can't be clustered: a licensed app server, a legacy tool, a small database. A single VM can still be production-grade.

#Sizing and placement

• VM size from measured CPU/RAM, with burstable (B-series) only for genuinely spiky, light workloads.
• Placed in an availability zone (zone 1, 2 or 3) rather than "no infrastructure redundancy". Zonal placement lets you use zone-redundant backup and makes a later HA design easier.
• Accelerated networking enabled where supported.

#Disks

• OS and data disks are Premium SSD or Premium SSD v2 (single-instance VM SLA of 99.9% needs Premium SSD/Ultra for all disks).
• Data on separate data disks, not the OS disk or the temporary disk (D: on Windows, /mnt on many Linux images is lost on redeploy).
• Host caching: ReadOnly for database data disks, None for log disks, ReadWrite only for the OS disk.

az vm show -g rg-app -n vm-app01 --query "storageProfile.dataDisks[].{lun:lun, sku:managedDisk.storageAccountType, caching:caching}" -o table

#Backup and restore

• Azure Backup enabled with an enhanced policy (multiple daily backups if RPO needs it).
• Recovery Services vault redundancy chosen consciously: GRS (with Cross Region Restore if you want DR from backups) or ZRS/LRS.
• Application-consistent snapshots (VSS on Windows; pre/post scripts for Linux databases).
• A test restore done and documented.

az backup protection enable-for-vm -g rg-backup --vault-name rsv-prod-cin --vm vm-app01 --policy-name daily-enhanced

#Security

• No public IP. Access via Azure Bastion or a VPN, with JIT if a management port must open.
• Trusted Launch (Secure Boot + vTPM) enabled.
• Encryption at host or disk encryption set (customer-managed keys if required).
• Microsoft Defender for Servers onboarded.
• Managed identity for access to Key Vault/Storage, no secrets in files.

#Patching

• Azure Update Manager maintenance configuration with a defined window and reboot setting.
• Patch orchestration set to AutomaticByPlatform (safe deployment) or customer-managed schedule, not "manual, someday".

#Monitoring

• Azure Monitor Agent + data collection rule (performance, events/syslog).
• Alerts: VM availability, CPU, memory, disk free space, backup failure.
• Boot diagnostics enabled (managed storage), so serial console works.

#Know what a single VM can't do

Write this table into the customer's runbook. It sets expectations and justifies HA when the business needs more.