Azure control plane and data plane

Azure operations are categorized into two types: control plane and data plane. You use the control plane operations to manage resources in your subscription, such as creating, updating, and deleting resources. You use the data plane operations to interact with data or functionality within these resources, such as reading and writing data.

The following table shows examples of these types of operations:

Azure Resource Manager is the control plane service in Azure. It provides a unified management layer for resources. The Azure REST API is the primary interface for interacting with the control plane, and it enables you to perform control plane operations programmatically. When you use tools like Azure PowerShell, Azure CLI or Azure portal, the requests are ultimately handled through Azure REST API operations. Requests from Azure SDKs also get handled through Azure REST API.

Azure Resource Manager exposes different URLs for different environments. All control plane requests go through one of these URLs:

1. Azure global URL: https://management.azure.com
2. Azure Government URL: https://management.usgovcloudapi.net
3. Azure Germany URL: https://management.microsoftazure.de
4. Microsoft Azure operated by 21Vianet: https://management.chinacloudapi.cn

The following example shows the Azure REST API operation to create a new storage account. Notice that it uses https://management.azure.com.

Azure Resource Manager authenticates the request and sends it to the relevant Azure service to complete the request.

For control plane operations, Azure Resource Manager provides several features for managing resources, including:

1. Azure role-based access control (Azure RBAC): Define access control policies for resources based on user roles.
2. Azure Policy: Create policies that govern resource properties and configurations.
3. Management Locks: Prevent accidental deletion or modification of resources by locking them.
4. Activity Logs: Maintain a record of all control plane operations performed on resources.

Azure Resource Manager seamlessly handles requests on both new resources and existing resources.

Green field scenarios refer to new deployments where there are no existing resources. Brown field scenarios involve managing and updating existing resources. As you deploy resources, Azure Resource Manager understands when to create new resources and when to update existing resources. You can manage resources throughout their lifecycle without worrying that identical resources are created.

Data plane operations use endpoints specific to each resource type.

The following example shows the data plane operation for creating a blob in an Azure Blob Storage account. Notice that the storage account name is part of the URL.

Data plane operations typically require separate credentials from control plane operations. These credentials are often resource-specific, such as credentials for signing in to a virtual machine or a shared access signature for a storage account.

If the control plane is unavailable, you can still access the data plane of your Azure resources. For example, you can access and manipulate data in your storage account resource through its separate storage URI https://myaccount.blob.core.windows.net even when https://management.azure.com is not available.

Features that enforce management and governance might not apply to data plane operations. You need to consider the different ways users interact with your solutions. For example, a lock that prevents users from deleting a database doesn’t prevent users from deleting data through queries.

You can use some policies to govern data plane operations. For more information, see Resource Provider modes (preview) in Azure Policy.

To learn more about Azure Resource Manager and how it can help you manage your Azure resources, see What is Azure Resource Manager?.

To learn more about the effect of policy definitions on new resources and existing resources, see Evaluate the impact of a new Azure Policy definition.