Virtual Machines
Azure integration · 17 node(s).
00Overview
The Azure Virtual Machines integration lets your workflows manage the lifecycle of Azure compute — creating, starting, stopping, restarting and deleting virtual machines — alongside network security groups, managed disks, snapshots, custom images, SSH keys and resource tags. Every action runs against a single subscription and either a specific resource group or, for the list actions, the whole subscription. You authenticate either with a Microsoft Entra ID service principal or a connected Azure account, and what each action can do is bounded by the Azure role you grant it.
Every field below is exactly what you see in the Flomation editor. Fields marked ● live picker let you choose from a list pulled live from your account — no IDs to look up.
01Connecting Virtual Machines
- In Microsoft Entra ID, register an application to act as a service principal and note its Directory (tenant) ID and Application (client) ID.
- Create a client secret for that application and copy its value immediately, as it is shown only once.
- Grant the application an Azure role on the subscription or resource group it will manage — read-only actions need a role such as Reader, while create, delete and lifecycle actions need Virtual Machine Contributor, Network Contributor or a similar role appropriate to the resource.
- In the node, set Authentication to Service Principal (keys) and fill in Tenant ID, Client ID and Subscription ID.
- Store the client secret as a Flomation environment secret and select it in the node's Client Secret field rather than typing it inline.
| Field | Type | Details | |
|---|---|---|---|
| Authentication | string | Service Principal (keys), Connect Azure | |
| Azure Connection | credential | Pick a connected Azure account | |
| Client Secret | secret | The app needs a role (e.g. Reader) on the subscription or resource group | |
| Tenant ID | string | Directory (tenant) ID — a GUID or your-tenant.onmicrosoft.com | |
| Client ID | string | Application (client) ID of the service principal | |
| Resource Group | string | Leave blank to list across the whole subscription (optional) | |
| Subscription ID | string | Required | Azure subscription GUID |
${secrets.your_secret}.02Disk
Azure Disk: List Managed Disks
azure/compute/disk_get_all · Action
List managed disks in a resource group (or across the whole subscription), with size, SKU and the VM each is attached to.
Returns: tool_result, disks, count, success, error
03Image
Azure Image: List Custom Images
azure/compute/image_get_all · Action
List custom managed images in a resource group (or across the whole subscription). Marketplace images are selected by publisher/offer/sku when creating a VM.
Returns: tool_result, images, count, success, error
04Nsg
Azure NSG: Add Inbound Rule
azure/compute/nsg_add_inbound_rule · Action
Add or update an inbound rule on a Network Security Group (protocol, ports, source/destination, allow or deny).
| Field | Type | Details | |
|---|---|---|---|
| Security Group Name | string | Required | my-nsg |
| Rule Name | string | Required | allow-ssh |
| Priority | integer | Required | 100–4096; lower wins |
| Protocol | string | Required | choices: TCP, UDP, Any |
| Destination Port(s) | string | Required | 22, or 80, or a range 8000-8100, or * for any |
| Access | string | choices: Allow, Deny | |
| Source Address | string | * (any), a CIDR like 10.0.0.0/24, or a tag like Internet — default * | |
| Source Port(s) | string | * (any) — default * | |
| Destination Address | string | * (any), a CIDR, or a tag like VirtualNetwork — default * |
Returns: tool_result, name, success, error
Azure NSG: Create Security Group
azure/compute/nsg_create · Action
Create a Network Security Group. It starts with Azure's default rules; add your own with the Add Inbound Rule action.
| Field | Type | Details | |
|---|---|---|---|
| Security Group Name | string | Required | my-nsg |
| Location | string | Required | uksouth |
Returns: tool_result, id, name, success, error
Azure NSG: Delete Security Group
azure/compute/nsg_delete · Action
Delete a Network Security Group. Azure refuses if it is still attached to a subnet or network interface.
| Field | Type | Details | |
|---|---|---|---|
| Security Group Name | string | Required | my-nsg |
Returns: tool_result, name, success, error
Azure NSG: List Security Groups
azure/compute/nsg_get_all · Action
List Network Security Groups in a resource group (or across the whole subscription), with their location, rule count and tags.
Returns: tool_result, network_security_groups, count, success, error
Azure NSG: Remove Inbound Rule
azure/compute/nsg_remove_inbound_rule · Action
Remove a named rule from a Network Security Group.
| Field | Type | Details | |
|---|---|---|---|
| Security Group Name | string | Required | my-nsg |
| Rule Name | string | Required | allow-ssh |
Returns: tool_result, name, success, error
05Resource
Azure Resource: Set Tags
azure/compute/resource_tag_set · Action
Add or update tags on any Azure resource by its ARM ID. Existing tags are preserved; only the supplied keys are added or overwritten.
| Field | Type | Details | |
|---|---|---|---|
| Resource ID | string | Required | Full ARM ID — /subscriptions/.../resourceGroups/.../providers/.../my-resource |
| Tags (JSON) | string | Required | {"env":"prod","owner":"ops"} |
Returns: tool_result, resource_id, tags, success, error
06Snapshot
Azure Snapshot: Create
azure/compute/snapshot_create · Action
Create a point-in-time snapshot of a managed disk. Waits until the snapshot is ready.
| Field | Type | Details | |
|---|---|---|---|
| Snapshot Name | string | Required | my-vm-osdisk-snap |
| Location | string | Required | uksouth |
| Source Disk ID | string | Required | Full ARM ID of the managed disk — /subscriptions/.../disks/my-disk |
Returns: tool_result, id, name, success, error
Azure Snapshot: List
azure/compute/snapshot_get_all · Action
List managed-disk snapshots in a resource group (or across the whole subscription), with size, state and location.
Returns: tool_result, snapshots, count, success, error
07Ssh
Azure SSH Key: List
azure/compute/ssh_key_get_all · Action
List stored SSH public keys in a resource group (or across the whole subscription). Only the public key is stored by Azure.
Returns: tool_result, ssh_keys, count, success, error
08Vm
Azure VM: Create
azure/compute/vm_create · Action
Create a Virtual Machine from a marketplace image, attached to an existing network interface. Waits until the VM is provisioned.
| Field | Type | Details | |
|---|---|---|---|
| VM Name | string | Required | my-vm (also used as the computer name) |
| Location | string | Required | uksouth |
| VM Size | string | Required | Standard_B1s |
| Image Publisher | string | Required | Canonical |
| Image Offer | string | Required | 0001-com-ubuntu-server-jammy |
| Image SKU | string | Required | 22_04-lts-gen2 |
| Image Version | string | latest (default) | |
| Admin Username | string | Required | azureuser |
| Admin Password | secret | Required | Must meet Azure complexity rules (12+ chars, 3 of 4 classes) |
| Network Interface ID | string | Required | Full ARM ID of an existing NIC — /subscriptions/.../networkInterfaces/my-nic |
| OS Disk Storage Type | string | Standard_LRS (default) — or StandardSSD_LRS, Premium_LRS |
Returns: tool_result, id, name, result, success, error
Azure VM: Stop (Deallocate)
azure/compute/vm_deallocate · Action
Stop a Virtual Machine and release its compute so it stops incurring compute charges. Waits until the VM is deallocated.
| Field | Type | Details | |
|---|---|---|---|
| VM Name | string | Required | my-vm |
Returns: tool_result, name, success, error
Azure VM: Delete
azure/compute/vm_delete · Action
Delete a Virtual Machine and wait until it is removed. Attached disks and network interfaces are not deleted.
| Field | Type | Details | |
|---|---|---|---|
| VM Name | string | Required | my-vm |
Returns: tool_result, name, success, error
Azure VM: List Virtual Machines
azure/compute/vm_get_all · Action
List Virtual Machines in a resource group (or across the whole subscription), with their power state (running/deallocated), size, location, OS and tags.
Returns: tool_result, virtual_machines, count, success, error
Azure VM: Restart
azure/compute/vm_restart · Action
Reboot a running Virtual Machine and wait until it is running again.
| Field | Type | Details | |
|---|---|---|---|
| VM Name | string | Required | my-vm |
Returns: tool_result, name, success, error
Azure VM: Start
azure/compute/vm_start · Action
Start a stopped or deallocated Virtual Machine and wait until it is running.
| Field | Type | Details | |
|---|---|---|---|
| VM Name | string | Required | my-vm |
Returns: tool_result, name, success, error
09Notes & Limitations
Behaviours and constraints worth knowing before you build with these nodes.
- Creating a virtual machine attaches it to a network interface that must already exist; the action does not build the virtual network, subnet or network interface for you, so provision those before running it.
- Some marketplace images require their publisher's terms to be accepted on the subscription before a VM can be created from them, so if creation is rejected for unaccepted terms, accept them once in the Azure portal or CLI and run the action again.
- The admin password must be at least 12 characters and meet Azure's complexity rules (at least three of the four classes: upper-case, lower-case, digit and symbol), and it is used exactly as entered, including any leading or trailing spaces.
- Fields that point at an existing resource — Network Interface ID, Source Disk ID and Resource ID — expect the resource's full ARM ID (/subscriptions/.../resourceGroups/...), not its short name.
- The list actions scope to a resource group when one is set and fall back to the entire subscription when the field is left blank, which can return far more results than expected.