Moving Marketplace images into existing resource groups


Not only Palo Alto, but alot of the templates hosted in the Azure Marketplace has restrictions to how we can deploy these resources. And it is mostly because the vendor wants to help you, but it doesn’t always fit with the existing infrastructure in Azure.

The two most annoying restrictions are:

1. Cannot be deployed to existing Resource Group.
2. Can only be deployed to an empty Resource Group.

My last challange was deploying two virtual appliances from Palo Alto using the BYOL image into an existing Resource Group and have them in the same Availability Set. For everyone that isn’t comfortable making all necessary changes to a copy of Palo Alto’s Github repository, we can use PowerShell to work around this challange.

Start by deploying the Palo Alto VMs using the Azure Marketplace image, and remember you can choose the vNet and Subnet from a different Resource Group.

It is possible to move resources using the Azure Portal, but this doesn’t apply to the virtual machine configuration it selves. Because it is connected to a plan, and throws an error when trying to move the virtual machines.

So in order to move all resources into your existing logical grouping of resources, we need to remove the VM configuration and configure all the resources back together after all of them have been moved.

To remove a VM configuration we use the Remove-AzureRmVM, and don’t worry, it doesn’t delete anything but the shell making all the resources into one VM:


We can now move all the resources using the Move-AzureRmResources.


Now that we have removed the VM configuration and moved the resource to the right Resource Group, we can create the VM configuration again and have the VM up and running. You can also add the Virtual Machines to an Availability Set while we configure them, so be sure to create a suiteable Availability Set to

To get the Publisher, Offer and Sku read my former post on Windows Server 2016 SKUs.


Leave a Comment