az

What it does

How to write it

az GROUP [SUBGROUP] COMMAND [--options] [-o table|json|tsv] [--query EXPR]

Main parts

Most used groups

login / logout / account

Sign in, choose the subscription.

group

Resource groups.

vm

Virtual machines.

network vnet|nsg|public-ip|lb

Networking.

storage account|container|blob

Storage.

aks

Azure Kubernetes Service.

acr

Azure Container Registry.

keyvault

Key Vault (secrets, keys, certificates).

role assignment / ad sp

RBAC and service principals.

monitor

Metrics, logs, alerts, diagnostic settings.

policy

Azure Policy.

resource

Any resource by ID.

webapp / containerapp / functionapp

App platforms.

deployment group create

Deploy Bicep or ARM templates.

upgrade / extension

Update the CLI / add extensions.

Most used

Nothing matches this filter.

$ run as a normal user# run as root (or with sudo)

1. 1Log in and choose a subscription

   $az login
   $az account list -o table
   $az account set --subscription "Lab Subscription"
   $az account show --query "{name:name, id:id}" -o table

2. 2Create a resource group and a VM

   $az group create -n rg-lab-weu -l westeurope --tags owner=s0sta env=lab
   $az vm create -g rg-lab-weu -n vm-web1 --image RedHat:RHEL:9-lvm-gen2:latest --size Standard_B2s --admin-username azureuser --ssh-key-values ~/.ssh/id_ed25519.pub --public-ip-sku Standard
   $az vm list -g rg-lab-weu -d -o table

3. 3Stop paying for a lab VM

   $az vm deallocate -g rg-lab-weu -n vm-web1
   $az vm start -g rg-lab-weu -n vm-web1

4. 4Network: VNet, subnet and NSG rule

   $az network vnet create -g rg-lab-weu -n vnet-lab --address-prefix 10.20.0.0/16 --subnet-name snet-web --subnet-prefix 10.20.1.0/24
   $az network nsg create -g rg-lab-weu -n nsg-web
   $az network nsg rule create -g rg-lab-weu --nsg-name nsg-web -n allow-https --priority 100 --access Allow --protocol Tcp --destination-port-ranges 443

5. 5Storage account with no public blob access

   $az storage account create -g rg-lab-weu -n sts0stalab01 --sku Standard_LRS --min-tls-version TLS1_2 --allow-blob-public-access false
   $az storage container create --account-name sts0stalab01 -n backups --auth-mode login

6. 6Key Vault and a secret

   $az keyvault create -g rg-lab-weu -n kv-s0sta-lab --enable-rbac-authorization true
   $az keyvault secret set --vault-name kv-s0sta-lab -n db-password --value "$(openssl rand -base64 24)"
   $az keyvault secret show --vault-name kv-s0sta-lab -n db-password --query value -o tsv

7. 7Create AKS and get the kubeconfig

   $az aks create -g rg-lab-weu -n aks-lab --node-count 2 --node-vm-size Standard_B2s --enable-managed-identity --network-plugin azure --generate-ssh-keys
   $az aks get-credentials -g rg-lab-weu -n aks-lab
   $kubectl get nodes

8. 8Give least-privilege access (RBAC)

   $az role assignment create --assignee user@example.com --role "Reader" --scope /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/rg-lab-weu
   $az role assignment list -g rg-lab-weu -o table

9. 9Find resources with a query

   $az resource list --tag env=lab --query "[].{name:name, type:type}" -o table
   $az vm list --query "[?powerState=='VM running'].name" -d -o tsv

10. 10Deploy a Bicep file

    $az deployment group create -g rg-lab-weu -f main.bicep -p env=lab
    $az deployment group what-if -g rg-lab-weu -f main.bicep

11. 11Clean up the whole lab

    $az group delete -n rg-lab-weu --yes --no-wait

Nothing matches this filter.

Files

~/.azure/

Login tokens and CLI config (keep private).

Exit codes