An Azure Linux VM fits teams that already use Azure identity, networking, policy, procurement, or adjacent data services. It is rarely the smallest infrastructure decision: the deployable unit includes the VM and several surrounding resources that need ownership and cost controls.
Model the complete Azure resource set
Keep the VM, network interface, public IP, network security group, and managed disk in a deliberately named resource group. Use tags for environment and ownership. Deleting the VM does not always mean every attached or neighboring billable resource is deleted, so document cleanup and audit the group after replacements.
B-series VMs accumulate and spend CPU credits. They can be economical for low-average-CPU services but are a poor default when builds or production requests need sustained CPU. Build in CI where practical and select a non-burstable family when measurements show the need.
Make effective NSG rules reviewable
Network security groups are stateful, priority-ordered rule sets. Azure includes a final inbound deny rule, so add only the required allows. If NSGs are associated with both the subnet and network interface, traffic must survive both sets of effective rules. Review the effective security rules on the VM rather than assuming one portal screen is the whole policy.
Use a static Standard public IP for a public single-VM deployment. Keep port 3000 or the configured Next.js listener private and route public 80/443 through the reverse proxy.
Budget and recover as a system
The displayed compute meter is not the complete server price. Use the Azure calculator with the exact region, hours, disk tier, public IP, backup, monitoring ingestion, and expected egress. Add alerts and budgets, but remember that alerts do not stop resources automatically.
Back up state outside the deployment artifact and test restoration. Before DNS cutover, validate the candidate VM with the production hostname, TLS, dynamic routes, images, streaming, cache behavior, and shutdown handling. Preserve a compatible prior target until rollback is no longer required.