Azure CLI Cheat Sheet
Core Azure CLI commands for managing resource groups, VMs, storage, and subscriptions from the terminal.
2 PagesBeginnerFeb 20, 2026
Login & Subscription Context
Authenticate and set the active subscription.
bash
az login # Interactive browser loginaz account list --output table # List subscriptionsaz account set --subscription "<id>" # Set active subscriptionaz account show # Show current contextaz configure --defaults group=myRG location=eastus # Set defaults
Resource Groups
Create and manage resource groups.
bash
az group create --name myRG --location eastusaz group list --output tableaz group show --name myRGaz group delete --name myRG --yes --no-wait
Virtual Machines
Create and control VMs.
bash
az vm create --resource-group myRG --name myVM \ --image Ubuntu2204 --admin-username azureuser \ --generate-ssh-keysaz vm start --resource-group myRG --name myVMaz vm stop --resource-group myRG --name myVMaz vm deallocate --resource-group myRG --name myVMaz vm list --output tableaz vm delete --resource-group myRG --name myVM --yes
Storage & Web Apps
Common storage account and App Service commands.
bash
az storage account create --name mystorageacct \ --resource-group myRG --sku Standard_LRSaz storage container create --name mycontainer \ --account-name mystorageacctaz webapp create --resource-group myRG --plan myPlan \ --name myUniqueAppName --runtime "NODE:18-lts"az webapp deployment source config-zip \ --resource-group myRG --name myUniqueAppName --src app.zip
Output & Query Options
Formatting and filtering CLI output.
- --output table- Render results as a human-readable table
- --output json- Default machine-readable JSON output
- --query- JMESPath expression to filter/shape output, e.g. --query "[].name"
- az find- AI-assisted search for CLI command examples
- az interactive- Launches interactive shell with autocomplete
- --dry-run- Not supported natively; use 'az deployment group validate' for ARM/Bicep dry runs
Bicep/ARM Deployment & Validation
Validate, preview, and deploy infrastructure-as-code templates with what-if analysis.
bash
# Validate a Bicep template compiles and its parameters are correctaz deployment group validate \ --resource-group myRG --template-file main.bicep --parameters env=prod# Preview exactly what will change before applying (no side effects)az deployment group what-if \ --resource-group myRG --template-file main.bicep --parameters env=prod# Deploy the templateaz deployment group create \ --resource-group myRG --template-file main.bicep --parameters env=prod# Decompile an existing ARM JSON template into Bicepaz bicep decompile --file azuredeploy.json
Virtual Networks & NSGs
Create a VNet with a subnet and lock it down with a network security group rule.
bash
az network vnet create --resource-group myRG --name myVNet \ --address-prefix 10.0.0.0/16 \ --subnet-name default --subnet-prefix 10.0.0.0/24az network nsg create --resource-group myRG --name myNSGaz network nsg rule create --resource-group myRG --nsg-name myNSG \ --name allow-ssh --priority 100 --direction Inbound \ --access Allow --protocol Tcp --destination-port-ranges 22 \ --source-address-prefixes '<your-ip>/32'az network vnet subnet update --resource-group myRG \ --vnet-name myVNet --name default --network-security-group myNSG
AKS Cluster Provisioning & kubectl Credentials
Bring up a managed Kubernetes cluster and wire kubectl to it.
bash
az aks create --resource-group myRG --name myAKS \ --node-count 3 --enable-managed-identity \ --generate-ssh-keys --network-plugin azure# Pull cluster credentials into ~/.kube/configaz aks get-credentials --resource-group myRG --name myAKS# Scale the default node poolaz aks nodepool scale --resource-group myRG --cluster-name myAKS \ --name nodepool1 --node-count 5# Upgrade control plane + node pool to a supported versionaz aks get-upgrades --resource-group myRG --name myAKS --output tableaz aks upgrade --resource-group myRG --name myAKS --kubernetes-version 1.29.4
Managed Identity & Key Vault Secrets
Grant a resource a managed identity and pull secrets without embedding credentials.
bash
# Enable a system-assigned managed identity on a web appaz webapp identity assign --resource-group myRG --name myUniqueAppName# Create a Key Vault and store a secretaz keyvault create --resource-group myRG --name myKV --location eastusaz keyvault secret set --vault-name myKV --name DbPassword --value 'S3cret!'# Grant the web app's managed identity access to read secretsaz keyvault set-policy --name myKV \ --object-id $(az webapp identity show --resource-group myRG --name myUniqueAppName --query principalId -o tsv) \ --secret-permissions get list# Reference the secret from app settings without ever storing it in codeaz webapp config appsettings set --resource-group myRG --name myUniqueAppName \ --settings DbPassword="@Microsoft.KeyVault(SecretUri=https://myKV.vault.azure.net/secrets/DbPassword/)"
Power-User CLI Concepts
Lesser-known commands and mechanics that go beyond basic resource CRUD.
- az extension- Install preview/optional command modules (az extension add --name aks-preview) not shipped in the core CLI.
- az rest- Call any Azure REST API endpoint directly with authenticated headers when no CLI command wraps it yet: az rest --method get --url ...
- Service principals- az ad sp create-for-rbac creates a non-interactive identity for CI/CD pipelines, scoped to a resource group with a specific role.
- Resource locks- az lock create --lock-type CanNotDelete prevents accidental deletion of critical resources even by users with Owner/Contributor rights.
- Tags- az resource tag applies key/value metadata for cost allocation and automation; supports bulk tagging with --tags across a resource group.
- az monitor activity-log- Query the audit trail of who changed what and when, useful for debugging unexpected resource state without opening the portal.
- --no-wait + az resource wait- Long-running operations can be fired asynchronously with --no-wait, then polled explicitly with az resource wait --created/--updated for scripting.
Pro Tip
Use 'az configure --defaults group=<rg> location=<loc>' at the start of a session so you stop repeating --resource-group and --location on every command.
Was this cheat sheet helpful?
Explore Topics
#AzureCLI#AzureCLICheatSheet#CloudComputing#Beginner#LoginSubscriptionContext#ResourceGroups#VirtualMachines#StorageWebApps#CommandLine#CheatSheet#SkillVeris
