Azure Dedicated Hosts

Azure Dedicated Hosts provide physical servers dedicated to one Azure subscription, ensuring that no other customer's virtual machines run on the same hardware. This isolation is critical for workloads that must comply with industry regulations such as HIPAA, PCI DSS, or government standards that require physical separation. Unlike isolated VMs (which use dedicated hardware within a shared host but still share the physical server with other tenants), Dedicated Hosts guarantee the entire server is yours.

When you provision a Dedicated Host, you are essentially leasing a physical server from Azure. The host is associated with an Azure region and availability zone. You then deploy VMs directly onto that host. The hypervisor (Microsoft Hyper-V) runs on the host, and only your VMs are allowed. The host has a specific SKU (e.g., Dsv3-Type1, Esv3-Type1) that determines the supported VM sizes and the number of vCPUs, RAM, and local storage available. Each host can run multiple VMs, up to the capacity of the host. For example, a Dsv3-Type1 host has 32 physical cores and 256 GB of RAM, so you could run up to 32 D2s v3 VMs (each with 2 vCPUs) or a mix of sizes as long as total vCPUs do not exceed 32.

- Dsv3-Type1: Supports Dsv3-series VMs (general purpose) - Esv3-Type1: Supports Esv3-series VMs (memory optimized) - Fsv2-Type2: Supports Fsv2-series VMs (compute optimized) - Msv2-Type1: Supports Msv2-series VMs (memory optimized, large) Each SKU has a defined number of vCPUs, RAM, and temporary disk. You cannot mix VM families on the same host (e.g., you cannot run D-series and E-series VMs on the same Dsv3 host). - Fault Domain: Within a host group, you can specify the number of fault domains (up to 3, matching availability zones). This is used for high availability across hosts. If you have multiple hosts in a group, you can spread VMs across fault domains to protect against host-level failures. - Maintenance Control: One of the biggest advantages of Dedicated Hosts is the ability to control when Azure performs maintenance that could reboot your VMs. You can schedule maintenance windows (e.g., every Sunday at 2 AM) and Azure will perform updates during that window. Without Dedicated Hosts, maintenance is managed by Azure and can happen at any time. - Azure Hybrid Benefit: With Dedicated Hosts, you can use your own Windows Server or SQL Server licenses with Software Assurance to save on licensing costs. You must enable Azure Hybrid Benefit at the host level, not per VM. This applies to all VMs on that host. - Capacity Reservation: When you provision a Dedicated Host, you reserve the full capacity of the host. You pay for the host regardless of how many VMs run on it. This is different from reserved instances, which reserve VM capacity but not the physical server.

To create a Dedicated Host using Azure CLI:

# Create a host group
az vm host group create --name myHostGroup --resource-group myRG --location eastus --platform-fault-domain-count 2

# Create a dedicated host
az vm host create --name myHost --resource-group myRG --host-group myHostGroup --sku Dsv3-Type1 --platform-fault-domain 0

# Create a VM on the host
az vm create --name myVM --resource-group myRG --image UbuntuLTS --size Standard_D2s_v3 --host myHost

You can also use the Azure portal: navigate to 'Dedicated hosts' under 'Virtual machines', create a host group, then add hosts. When creating a VM, select 'Dedicated host' under 'Advanced' and choose the host group.

Azure performs regular maintenance on physical hosts, including security patches and firmware updates. With Dedicated Hosts, you can control when these updates occur. You can configure a maintenance schedule using Azure Maintenance Configurations. The maintenance window is set at the host group level. During the window, Azure will reboot VMs as needed. You can also manually initiate a maintenance event (e.g., to apply a critical security patch) using the 'Redeploy' operation on the host, which will migrate VMs to another host in the group if available.

A hospital system must run an electronic health records (EHR) application that processes protected health information (PHI). To comply with HIPAA, they require physical isolation from other tenants. They deploy a Dedicated Host group with two hosts in different availability zones for high availability. Each host runs a mix of D4s v3 VMs for the application tier and E4s v3 VMs for the database tier (using separate hosts for different families). They enable Azure Hybrid Benefit on the hosts to use their existing Windows Server and SQL Server licenses, saving 40% on licensing costs. Maintenance is scheduled for Saturday nights to minimize disruption. The challenge: they initially underestimated the number of VMs needed, causing a capacity crunch. They had to add a third host to the group, which required re-evaluating fault domain distribution.

A bank needs to run a trading application that requires audit trails showing that no other customer's workload could interfere. They use Dedicated Hosts with manual placement to ensure specific VMs stay on specific hosts. They also use Azure Policy to enforce that all production VMs are deployed on Dedicated Hosts. The host group spans three fault domains. During a regulatory audit, they provide the host list and VM placement as evidence of isolation. One issue: they discovered that Azure Backup jobs were causing unexpected I/O spikes, impacting trading performance. They mitigated by using Azure NetApp Files with dedicated capacity. The key lesson: Dedicated Hosts isolate compute, but storage and network are still shared, so you must also consider those layers for full isolation.

A large enterprise runs thousands of Windows Server VMs. They have Software Assurance and want to maximize Azure Hybrid Benefit savings. They create Dedicated Hosts for each VM family (e.g., D-series, E-series) and enable Azure Hybrid Benefit at the host level. They use Azure Reservations for the hosts to get a 3-year term discount. They also use Azure Policy to prevent deployment of VMs without Azure Hybrid Benefit on those hosts. The challenge: they had to migrate existing VMs from shared infrastructure to Dedicated Hosts. They used Azure Migrate with minimal downtime. The migration revealed that some VMs were using unsupported sizes (e.g., B-series burstable), which forced them to resize or create additional hosts. They also learned that they needed to plan for host maintenance windows to avoid conflicts with business hours.