Deployment Flow

Preview

New-AzureSqlVmToolkitDeployment -ConfigFile .\config.local.yaml -SecurityAssessmentAdvice -Plan

The preview validates config and prints intended resource names without Azure calls.

Use Azure-aware -WhatIf after signing in to check real create/reuse/update/drift decisions without mutating resources:

Connect-AzAccount
New-AzureSqlVmToolkitDeployment -ConfigFile .\config.local.yaml -WhatIf

Deployment Steps

After Connect-AzAccount, the module command runs the same reconciliation order through internal Ensure-* functions:

1. Creates or reuses the VM resource group.
2. Creates or reuses the storage resource group.
3. Creates or validates an RBAC-enabled Key Vault.
4. Assigns Key Vault secret permissions.
5. Reuses the VM admin password secret, or generates one only with -GeneratePassword.
6. Creates or reuses VNet, subnet, NSG, NIC, and optional VM public IP.
7. Creates or reuses the SQL Server VM.
8. Enables system-assigned managed identity.
9. Creates or reuses Bastion subnet, Bastion public IP, and Bastion host.
10. Creates or reuses storage account and Azure Files share.
11. Stores the storage account key in Key Vault.
12. Grants the VM identity secret-reader permission.
13. Runs trusted guest setup through VM Run Command.
14. Mounts Azure Files in the VM and registers a startup task.
15. Uploads restore-databases.ps1.

Reruns

The toolkit uses create-or-reuse behavior for the major Azure resources and reports structured step results. Unsafe drift fails early for resources that should not be silently reused, including wrong VNet/subnet prefixes, wrong NIC attachments, legacy Key Vault access-policy mode, VM size drift, and VM image drift. Missing safe items such as role assignments, managed identity, Bastion subnet, and configured NSG rules are handled as updates.