Azure CLI Commands Master Class #

Engineering-grade reference manual for Azure CLI operations across resource groups, compute, storage, networking, AKS, Functions, Monitor, Key Vault, and Azure DevOps.

Overview #

Azure CLI (az) is the fastest imperative interface for inspecting and operating Azure environments. Use Terraform/Bicep for desired-state infrastructure, but use Azure CLI for discovery, one-off operations, troubleshooting, CI/CD glue, and verified evidence collection.

Login and Subscription Context #

Check CLI version:

az version

Sign in interactively:

az login

List subscriptions:

az account list -o table

Set active subscription:

az account set --subscription SUBSCRIPTION_ID

Show current account context:

az account show --query '{name:name,id:id,tenant:tenantId,user:user.name}' -o table

Output Formats and Query Patterns #

Use table output for humans:

az group list -o table

Use JSON for automation:

az group list -o json

Shape results with JMESPath:

az group list --query '[].{name:name,location:location}' -o table

Filter resources by tag:

az resource list --tag environment=prod --query '[].{name:name,type:type,rg:resourceGroup}' -o table

Resource Groups #

Create a resource group:

az group create --name rg-demo-eastus --location eastus

Show a resource group:

az group show --name rg-demo-eastus -o json

List resources in a resource group:

az resource list --resource-group rg-demo-eastus -o table

Tag a resource group:

az group update --name rg-demo-eastus --set tags.owner=platform tags.environment=dev

Delete a resource group after approval:

az group delete --name rg-demo-eastus --yes --no-wait

Resource Inventory with Azure Resource Graph #

Install extension:

az extension add --name resource-graph

List resource counts by type:

az graph query -q "Resources | summarize count() by type | order by count_ desc" -o table

Find public IP addresses:

az graph query -q "Resources | where type =~ 'microsoft.network/publicipaddresses' | project name, resourceGroup, location, properties.ipAddress" -o table

Find untagged resources:

az graph query -q "Resources | where isempty(tags['owner']) | project name, type, resourceGroup, location" -o table

Virtual Machines #

List VMs:

az vm list -d -o table

Create a Linux VM:

az vm create \
  --resource-group rg-demo-eastus \
  --name vm-demo-01 \
  --image Ubuntu2204 \
  --admin-username azureuser \
  --generate-ssh-keys

Show VM power state:

az vm get-instance-view --resource-group rg-demo-eastus --name vm-demo-01 --query instanceView.statuses -o table

Start and stop a VM:

az vm start --resource-group rg-demo-eastus --name vm-demo-01
az vm deallocate --resource-group rg-demo-eastus --name vm-demo-01

Run a command on a VM:

az vm run-command invoke \
  --resource-group rg-demo-eastus \
  --name vm-demo-01 \
  --command-id RunShellScript \
  --scripts 'uname -a && uptime'

Disks and Snapshots #

List managed disks:

az disk list -o table

Find unattached disks:

az disk list --query '[?managedBy==null].{name:name,rg:resourceGroup,sku:sku.name,size:diskSizeGb}' -o table

Create a snapshot:

az snapshot create \
  --resource-group rg-demo-eastus \
  --name vm-demo-01-osdisk-snap \
  --source DISK_RESOURCE_ID

Virtual Networks #

Create a VNet and subnet:

az network vnet create \
  --resource-group rg-demo-eastus \
  --name vnet-demo \
  --address-prefix 10.20.0.0/16 \
  --subnet-name subnet-app \
  --subnet-prefix 10.20.1.0/24

List VNets:

az network vnet list -o table

Create a network security group:

az network nsg create --resource-group rg-demo-eastus --name nsg-app

Allow HTTPS:

az network nsg rule create \
  --resource-group rg-demo-eastus \
  --nsg-name nsg-app \
  --name AllowHTTPS \
  --priority 100 \
  --destination-port-ranges 443 \
  --access Allow \
  --protocol Tcp

List effective NSG rules for a NIC:

az network nic list-effective-nsg --resource-group rg-demo-eastus --name NIC_NAME -o table

Storage Accounts #

Create storage account:

az storage account create \
  --resource-group rg-demo-eastus \
  --name storagedemo12345 \
  --location eastus \
  --sku Standard_LRS \
  --kind StorageV2

List storage accounts:

az storage account list -o table

Create blob container:

az storage container create \
  --account-name storagedemo12345 \
  --name artifacts \
  --auth-mode login

Upload a file:

az storage blob upload \
  --account-name storagedemo12345 \
  --container-name artifacts \
  --name app.tar.gz \
  --file app.tar.gz \
  --auth-mode login

List blobs:

az storage blob list --account-name storagedemo12345 --container-name artifacts --auth-mode login -o table

Azure Container Registry #

Create registry:

az acr create --resource-group rg-demo-eastus --name acrdemo12345 --sku Basic

Log in:

az acr login --name acrdemo12345

List repositories:

az acr repository list --name acrdemo12345 -o table

Build and push with ACR Tasks:

az acr build --registry acrdemo12345 --image webapp:v1 .

AKS Operations #

Create AKS cluster:

az aks create \
  --resource-group rg-demo-eastus \
  --name aks-demo \
  --node-count 2 \
  --enable-managed-identity \
  --generate-ssh-keys

Get kubeconfig:

az aks get-credentials --resource-group rg-demo-eastus --name aks-demo

Show cluster version and node resource group:

az aks show --resource-group rg-demo-eastus --name aks-demo --query '{version:kubernetesVersion,nodeRG:nodeResourceGroup}' -o table

Upgrade cluster after review:

az aks upgrade --resource-group rg-demo-eastus --name aks-demo --kubernetes-version VERSION

Scale node pool:

az aks nodepool scale --resource-group rg-demo-eastus --cluster-name aks-demo --name nodepool1 --node-count 3

App Service and Web Apps #

Create App Service plan:

az appservice plan create --resource-group rg-demo-eastus --name plan-web --sku B1 --is-linux

Create web app:

az webapp create --resource-group rg-demo-eastus --plan plan-web --name web-demo-143it --runtime 'NODE:20-lts'

Configure app settings with placeholders:

az webapp config appsettings set \
  --resource-group rg-demo-eastus \
  --name web-demo-143it \
  --settings API_BASE_URL='https://api.example.com' TOKEN_VALUE='[REDACTED]'

Tail logs:

az webapp log tail --resource-group rg-demo-eastus --name web-demo-143it

Azure Functions #

Create storage for Functions:

az storage account create --resource-group rg-demo-eastus --name funcstor12345 --location eastus --sku Standard_LRS

Create Function App:

az functionapp create \
  --resource-group rg-demo-eastus \
  --consumption-plan-location eastus \
  --runtime node \
  --runtime-version 20 \
  --functions-version 4 \
  --name func-demo-143it \
  --storage-account funcstor12345

List functions:

az functionapp function list --resource-group rg-demo-eastus --name func-demo-143it -o table

Key Vault #

Create Key Vault:

az keyvault create --resource-group rg-demo-eastus --name kv-demo-143it --location eastus

Store a placeholder secret:

az keyvault secret set --vault-name kv-demo-143it --name demo-token --value '[REDACTED]'

List secret names without values:

az keyvault secret list --vault-name kv-demo-143it --query '[].name' -o table

Show metadata only:

az keyvault secret show --vault-name kv-demo-143it --name demo-token --query '{name:name,enabled:attributes.enabled,updated:attributes.updated}' -o table

Azure Monitor and Logs #

List Log Analytics workspaces:

az monitor log-analytics workspace list -o table

Run a KQL query:

az monitor log-analytics query \
  --workspace WORKSPACE_ID \
  --analytics-query "Heartbeat | summarize count() by Computer | order by count_ desc" \
  -o table

List metric definitions:

az monitor metrics list-definitions --resource RESOURCE_ID -o table

Query CPU metrics:

az monitor metrics list --resource RESOURCE_ID --metric Percentage CPU --interval PT5M -o table

Azure DevOps CLI #

Install extension:

az extension add --name azure-devops

Set organization defaults:

az devops configure --defaults organization=https://dev.azure.com/ORG project=PROJECT

List pipelines:

az pipelines list -o table

Run a pipeline:

az pipelines run --name PIPELINE_NAME

List repos:

az repos list -o table

Role-Based Access Control #

List role assignments for a user or service principal:

az role assignment list --assignee PRINCIPAL_ID -o table

Assign reader role at resource group scope:

az role assignment create \
  --assignee PRINCIPAL_ID \
  --role Reader \
  --scope /subscriptions/SUBSCRIPTION_ID/resourceGroups/rg-demo-eastus

Remove role assignment:

az role assignment delete --assignee PRINCIPAL_ID --role Reader --scope SCOPE_ID

Cost and Governance Checks #

List budgets:

az consumption budget list -o table

List policy assignments:

az policy assignment list --query '[].{name:name,scope:scope,policy:policyDefinitionId}' -o table

List locks:

az lock list -o table

Troubleshooting Azure CLI #

Show current cloud:

az cloud show -o table

Clear cached account data carefully:

az account clear

Refresh provider registration:

az provider register --namespace Microsoft.ContainerService

Check operation result:

az resource show --ids RESOURCE_ID --query properties.provisioningState -o tsv

Production Review Checklist #

1. Confirm subscription context before changes.
2. Use --query to limit sensitive output.
3. Use placeholders for secrets in examples and scripts.
4. Prefer managed identity over client secrets.
5. Capture evidence in JSON for audits.
6. Scope destructive commands to explicit resource groups.
7. Use --no-wait only when follow-up status checks are documented.
8. Keep Terraform/Bicep as source of truth when resources are managed declaratively.

Quick Reference #

az account show -o table
az group list -o table
az resource list --resource-group rg-demo-eastus -o table
az vm list -d -o table
az network vnet list -o table
az storage account list -o table
az acr repository list --name acrdemo12345 -o table
az aks get-credentials --resource-group rg-demo-eastus --name aks-demo
az webapp log tail --resource-group rg-demo-eastus --name web-demo-143it
az monitor metrics list --resource RESOURCE_ID --metric "Percentage CPU"
az graph query -q "Resources | summarize count() by type" -o table